D4.2: validate declared identities against retained reservations by omry · Pull Request #294 · omry/reploy

omry · 2026-10-27T22:02:33Z

Validate every locked application UID and GID against canonical retained reservation geometry before mapping configuration or mapped build verification can reach effects. Report missing declarations in numeric order with the selected build generation.

Reuse the existing locked build loader and protected retention calculation. Preserve host authorization, pending replacement semantics and all public mapped execution guards. Add boundary, retention and pre-effect denial tests plus a Changie fragment.

Validate every locked application UID and GID against canonical retained reservation geometry before mapping configuration or mapped build verification can reach effects. Report missing declarations in numeric order with the selected build generation. Reuse the existing locked build loader and protected retention calculation. Preserve host authorization, pending replacement semantics and all public mapped execution guards. Add boundary, retention and pre-effect denial tests plus a Changie fragment.

gitar-bot · 2026-10-27T22:03:40Z

Code Review ✅ Approved

🟡 Medium risk · Validating locked user and group IDs against retained reservations could block mapping configuration or mapped-build verification when coverage is incomplete.

Validates every locked application UID and GID against canonical retained reservation geometry before mapping configuration or mapped build verification can take effect, reporting missing declarations in numeric order with the selected build generation. No issues found.

Verification

Rules No rules evaluated

Functional validation Not enabled

Set up

_{For more verification details, comment gitar display:verbose.}

Options

Auto-apply is off → Gitar will not commit updates to this branch.
Display: compact → Showing compact verification results.

Comment with these commands to change the behavior for this request:

`Auto-apply`	`Compact`
`gitar auto-apply:on`	`gitar display:verbose`

_{Was this helpful? React with 👍 / 👎 | Powered by Gitar — free for open source}

omry · 2026-10-27T22:05:23Z

PR-cycle state — maintained automatically. Do not edit by hand.

Mechanical PR-cycle state (JSON)

{
  "approval": {
    "candidate_revision_fingerprint": "sha256:a1b598ca13da041e0c352bcc1b28f69d19414676417d6f03ffec7ba011c48342",
    "evidence": {
      "attestations": [
        {
          "baseline_identity": "sha256:146b305ae1732ad14e8c5eef04d4f5ec47db383706172645f8cf324fde970166",
          "closure_identity": "sha256:e64977205694b233e447c11af44aa8874651ac337576852d4813291880e52964",
          "document_identity": "sha256:fee62dbad94f6815fdccc1920a7180864dfef8e5ad9238e0fdee689a87db5573",
          "sidecar_identity": "sha256:ef591acea1e1d83645b8d05a175752075b4284d750a5cf289cfa7e1ff8f1180c"
        },
        {
          "baseline_identity": "sha256:779702b5fa170b026d6a04df2aeaa97ce006b96bcba41897ca39babd8b956e83",
          "closure_identity": "sha256:e64977205694b233e447c11af44aa8874651ac337576852d4813291880e52964",
          "document_identity": "sha256:0339661e75fd610092b903a1352c65ef98de35c4963c613923f0c9852193c597",
          "sidecar_identity": "sha256:4dfd0c546d6d2e562cc7a566336696f9064ebe740c2ec04774e9a9fdceef5437"
        },
        {
          "baseline_identity": "sha256:a68d5bec4bca25c403f41460bd202236954d42c9524b3fe50a7210e0af055387",
          "closure_identity": "sha256:e64977205694b233e447c11af44aa8874651ac337576852d4813291880e52964",
          "document_identity": "sha256:ba63be4406185d978f1794a3c22b2598a80288a0cff47ce018ff1e8ef745870c",
          "sidecar_identity": "sha256:7e9de65c8d26ece8f101b0f61307340bf736ab67be0f959e23d611a3492566f4"
        },
        {
          "closure_identity": "sha256:e64977205694b233e447c11af44aa8874651ac337576852d4813291880e52964",
          "document_identity": "sha256:779702b5fa170b026d6a04df2aeaa97ce006b96bcba41897ca39babd8b956e83",
          "sidecar_identity": "sha256:63430091146b6ed1c3c6db0e08608fc1d94e0a09e176adeedb8c3a2d5da56bbf"
        }
      ],
      "candidate_revision_fingerprint": "sha256:a1b598ca13da041e0c352bcc1b28f69d19414676417d6f03ffec7ba011c48342",
      "check_conclusions": [
        {
          "conclusion": "SUCCESS",
          "name": "Bash native evidence checks",
          "run_id": 122505623237
        },
        {
          "conclusion": "SUCCESS",
          "name": "Gitar",
          "run_id": 122497256454
        },
        {
          "conclusion": "SUCCESS",
          "name": "Linux CI checks",
          "run_id": 122497230665
        },
        {
          "conclusion": "SUCCESS",
          "name": "Target smoke (darwin-amd64)",
          "run_id": 122497231187
        },
        {
          "conclusion": "SUCCESS",
          "name": "Target smoke (darwin-arm64)",
          "run_id": 122497231126
        },
        {
          "conclusion": "SUCCESS",
          "name": "Target smoke (linux-amd64)",
          "run_id": 122497231096
        },
        {
          "conclusion": "SUCCESS",
          "name": "Target smoke (linux-arm64)",
          "run_id": 122497231036
        },
        {
          "conclusion": "SUCCESS",
          "name": "Windows host smoke (windows-amd64)",
          "run_id": 122497231153
        },
        {
          "conclusion": "SUCCESS",
          "name": "Windows host smoke (windows-arm64)",
          "run_id": 122497231004
        }
      ],
      "delivery_deferral_ledger_digest": "sha256:4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945",
      "finding_dispositions_digest": "sha256:4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945",
      "operation_identity": "sha256:8c12da8621f9a46fb78fef1fae0a0c7549ea8ec0f55b257eee90c8c8acdbc956",
      "review_request": {
        "body_digest": "sha256:966d7acd62107ef6c20770ea24fca8d10d69205a0837f4cda8564210548d0873",
        "id": 6454809147
      },
      "review_result": {
        "body_digest": "sha256:1ed1d951764ddcd14efd94ed76098378d5f59c1eaa31d2ac97c4ffe72e4039cc",
        "id": 6454827492
      }
    },
    "evidence_fingerprint": "sha256:d482c87a7d4e772014dff012f91db5cb1ea3d47748aa10018ad4c2982b3ca8fe",
    "head_sha": "06283be1ae0abad3538cb2bd4ec6b0fa227fffd4",
    "operation_identity": "sha256:8c12da8621f9a46fb78fef1fae0a0c7549ea8ec0f55b257eee90c8c8acdbc956",
    "review_request_id": 6454809147,
    "review_result_id": 6454827492,
    "status": "approved-evidence-recorded"
  },
  "candidate_revision_fingerprint": "sha256:a1b598ca13da041e0c352bcc1b28f69d19414676417d6f03ffec7ba011c48342",
  "check_conclusions": [
    {
      "conclusion": "SUCCESS",
      "name": "Bash native evidence checks",
      "run_id": 122505623237
    },
    {
      "conclusion": "SUCCESS",
      "name": "Gitar",
      "run_id": 122497256454
    },
    {
      "conclusion": "SUCCESS",
      "name": "Linux CI checks",
      "run_id": 122497230665
    },
    {
      "conclusion": "SUCCESS",
      "name": "Target smoke (darwin-amd64)",
      "run_id": 122497231187
    },
    {
      "conclusion": "SUCCESS",
      "name": "Target smoke (darwin-arm64)",
      "run_id": 122497231126
    },
    {
      "conclusion": "SUCCESS",
      "name": "Target smoke (linux-amd64)",
      "run_id": 122497231096
    },
    {
      "conclusion": "SUCCESS",
      "name": "Target smoke (linux-arm64)",
      "run_id": 122497231036
    },
    {
      "conclusion": "SUCCESS",
      "name": "Windows host smoke (windows-amd64)",
      "run_id": 122497231153
    },
    {
      "conclusion": "SUCCESS",
      "name": "Windows host smoke (windows-arm64)",
      "run_id": 122497231004
    }
  ],
  "check_observations": [
    {
      "checks": [
        {
          "conclusion": "SUCCESS",
          "name": "Bash native evidence checks",
          "run_id": 122505623237,
          "run_status": "completed",
          "status": "success",
          "url": "https://github.com/omry/reploy/actions/runs/40591676033/job/122505623237"
        },
        {
          "conclusion": "SUCCESS",
          "name": "Gitar",
          "run_id": 122497256454,
          "run_status": "completed",
          "status": "success",
          "url": "https://github.com/omry/reploy/runs/122497256454"
        },
        {
          "conclusion": "SUCCESS",
          "name": "Linux CI checks",
          "run_id": 122497230665,
          "run_status": "completed",
          "status": "success",
          "url": "https://github.com/omry/reploy/actions/runs/40591676033/job/122497230665"
        },
        {
          "conclusion": "SUCCESS",
          "name": "Target smoke (darwin-amd64)",
          "run_id": 122497231187,
          "run_status": "completed",
          "status": "success",
          "url": "https://github.com/omry/reploy/actions/runs/40591676033/job/122497231187"
        },
        {
          "conclusion": "SUCCESS",
          "name": "Target smoke (darwin-arm64)",
          "run_id": 122497231126,
          "run_status": "completed",
          "status": "success",
          "url": "https://github.com/omry/reploy/actions/runs/40591676033/job/122497231126"
        },
        {
          "conclusion": "SUCCESS",
          "name": "Target smoke (linux-amd64)",
          "run_id": 122497231096,
          "run_status": "completed",
          "status": "success",
          "url": "https://github.com/omry/reploy/actions/runs/40591676033/job/122497231096"
        },
        {
          "conclusion": "SUCCESS",
          "name": "Target smoke (linux-arm64)",
          "run_id": 122497231036,
          "run_status": "completed",
          "status": "success",
          "url": "https://github.com/omry/reploy/actions/runs/40591676033/job/122497231036"
        },
        {
          "conclusion": "SUCCESS",
          "name": "Windows host smoke (windows-amd64)",
          "run_id": 122497231153,
          "run_status": "completed",
          "status": "success",
          "url": "https://github.com/omry/reploy/actions/runs/40591676033/job/122497231153"
        },
        {
          "conclusion": "SUCCESS",
          "name": "Windows host smoke (windows-arm64)",
          "run_id": 122497231004,
          "run_status": "completed",
          "status": "success",
          "url": "https://github.com/omry/reploy/actions/runs/40591676033/job/122497231004"
        }
      ],
      "head_sha": "06283be1ae0abad3538cb2bd4ec6b0fa227fffd4",
      "id": "sha256:e2b01c759e7e54862af71c2de3b9f3bdc6da28fbeae891ab5b6fb408e699de52",
      "required_checks": [
        "Bash native evidence checks",
        "Gitar",
        "Linux CI checks",
        "Target smoke (darwin-amd64)",
        "Target smoke (darwin-arm64)",
        "Target smoke (linux-amd64)",
        "Target smoke (linux-arm64)",
        "Windows host smoke (windows-amd64)",
        "Windows host smoke (windows-arm64)"
      ],
      "status": "success"
    }
  ],
  "delivery_deferral_ledger_digest": "sha256:4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945",
  "delivery_deferrals": [],
  "findings": [],
  "pr": {
    "base_ref": "pr293",
    "base_sha": "9eae266dd705cd536e9d7c0995ae4d205b1c1505",
    "body_digest": "sha256:cc192fb173437c90b44608ca00425cf985b27c20c90519a46a4431a0426b123b",
    "body_identity_version": 2,
    "diff_digest": "sha256:0e45508b711331a384752e7ce37a5945cbf02c14a14d56d733f46620cdd514e9",
    "head_ref": "pr294",
    "head_sha": "06283be1ae0abad3538cb2bd4ec6b0fa227fffd4",
    "pr": 294,
    "repository": "omry/reploy",
    "scope_authority": [
      {
        "digest": "sha256:078e63e84d432c2aad03120ca30e40ec4572a8970e6bf6be9d5008608a30f435",
        "path": "docs/MULTI_IDENTITY_D_DESIGN.md"
      },
      {
        "digest": "sha256:3ef44a7a0be43648f5df1faad39b16101978662c58c87d6fa8e7409093a58fe9",
        "path": "docs/MULTI_IDENTITY_IMPLEMENTATION_PLAN.md"
      },
      {
        "digest": "sha256:fe188bb8a80f7f235e99b023283749a3a9e3172e4adf70b70b495d80e50e9218",
        "path": "docs/MULTI_IDENTITY_MAIL_RECONCILIATION.md"
      },
      {
        "digest": "sha256:b049714f4a85d0f3fb204615897374377690564627bfcdd03e50c945fb042826",
        "path": "docs/MULTI_IDENTITY_SECURITY_CONTRACT.md"
      }
    ],
    "title_digest": "sha256:dee816da24b96e71255f623f3f988931a954fd9f975c18e23afb3cfb62f7be9a"
  },
  "record_version": 4,
  "review_observations": [],
  "review_requests": [
    {
      "base_established_at": "2026-10-27T22:02:36Z",
      "base_ref": "pr293",
      "base_sha": "9eae266dd705cd536e9d7c0995ae4d205b1c1505",
      "body_digest": "sha256:966d7acd62107ef6c20770ea24fca8d10d69205a0837f4cda8564210548d0873",
      "created_at": "2026-10-27T22:07:57Z",
      "head_sha": "06283be1ae0abad3538cb2bd4ec6b0fa227fffd4",
      "id": 6454809147,
      "kind": "regular-review"
    }
  ],
  "review_results": [
    {
      "base_ref": "pr293",
      "base_sha": "9eae266dd705cd536e9d7c0995ae4d205b1c1505",
      "body_digest": "sha256:1ed1d951764ddcd14efd94ed76098378d5f59c1eaa31d2ac97c4ffe72e4039cc",
      "commit_id": "06283be1ae0abad3538cb2bd4ec6b0fa227fffd4",
      "id": 6454827492,
      "inline_message_ids": [],
      "request_comment_id": 6454809147,
      "result_kind": "clean",
      "status": "result",
      "submitted_at": "2026-10-27T22:09:02Z",
      "unresolved_thread_ids": []
    }
  ],
  "revision_fingerprint": "sha256:a1b598ca13da041e0c352bcc1b28f69d19414676417d6f03ffec7ba011c48342",
  "rounds": [
    {
      "applied_fix_paths": [],
      "disposition_changes": [],
      "effective_diff_digest": "sha256:0e45508b711331a384752e7ce37a5945cbf02c14a14d56d733f46620cdd514e9",
      "finding_ids": [],
      "invariants": [
        "Every locked declared application UID/GID has retained reservation coverage; all public execution guards remain inhibited.",
        "All9 exact-head checks and complete qualified local validation passed; attributable remote review clean."
      ],
      "outcome": "clean",
      "proposed_fix_paths": [],
      "resulting_head": "06283be1ae0abad3538cb2bd4ec6b0fa227fffd4",
      "review_observation_id": null,
      "review_request_id": 6454809147,
      "review_result_id": 6454827492,
      "reviewed_head": "06283be1ae0abad3538cb2bd4ec6b0fa227fffd4",
      "root_cause": null,
      "round": 1,
      "unresolved_current_slice_findings": 0,
      "unresolved_design_blockers": 0
    }
  ],
  "schema": "awd:swe:pr-cycle-state",
  "version": 2
}

chatgpt-codex-connector · 2026-10-27T22:06:24Z

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-27T22:09:03.483785Z	`06283be`	Manual request
🔒 Security Review	⚠️ Failed 2026-10-27T22:06:21.046752Z We couldn’t complete this review. Comment `@codex security review` to try again.	`06283be`	Draft marked ready

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

chatgpt-codex-connector · 2026-10-27T22:06:26Z

The account paying for this security review has reached its Codex usage limits. The payer can check the Codex usage dashboard. For personal accounts, using credits requires enabling “Use credits for security reviews” in Code review settings. If you do not manage the paying account, contact this repository's admins.

omry · 2026-10-27T22:07:57Z

@codex review

Exact head: 06283be

chatgpt-codex-connector · 2026-10-27T22:09:02Z

Codex Review: Didn't find any major issues. Bravo.

Reviewed commit: 06283be1ae

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

omry changed the base branch from main to pr293 October 27, 2026 22:02

omry added this pull request to stack #287 October 27, 2026 22:02

omry marked this pull request as ready for review October 27, 2026 22:06

omry added the approved PR reviewed and approved label Oct 27, 2026

omry merged commit 8a0f78c into main Oct 28, 2026
9 checks passed

omry deleted the pr294 branch October 28, 2026 04:55

Navigation Menu

Repository navigation

D4.2: validate declared identities against retained reservations - #294

D4.2: validate declared identities against retained reservations#294
omry merged 1 commit into
pr293from
pr294

omry commented Oct 27, 2026 •

edited

Loading

Uh oh!

gitar-bot Bot commented Oct 27, 2026 •

edited

Loading

Uh oh!

omry commented Oct 27, 2026 •

edited

Loading

Uh oh!

chatgpt-codex-connector Bot commented Oct 27, 2026 •

edited

Loading

Uh oh!

chatgpt-codex-connector Bot commented Oct 27, 2026

Uh oh!

omry commented Oct 27, 2026

Uh oh!

chatgpt-codex-connector Bot commented Oct 27, 2026

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

omry commented Oct 27, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

gitar-bot Bot commented Oct 27, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

omry commented Oct 27, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

chatgpt-codex-connector Bot commented Oct 27, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codex Review Summary

Uh oh!

chatgpt-codex-connector Bot commented Oct 27, 2026

Uh oh!

omry commented Oct 27, 2026

Uh oh!

chatgpt-codex-connector Bot commented Oct 27, 2026

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

omry commented Oct 27, 2026 •

edited

Loading

gitar-bot Bot commented Oct 27, 2026 •

edited

Loading

omry commented Oct 27, 2026 •

edited

Loading

chatgpt-codex-connector Bot commented Oct 27, 2026 •

edited

Loading