E1.1: compile execution identity closure and active maps by omry · Pull Request #298 · omry/reploy

omry · 2026-10-28T13:27:10Z

Compile a pure execution-map plan from immutable D identity evidence and separately supplied reservation and admission history. Exact maps project all declared identities and reject unexplained surplus; bounded maps preserve their complete accepted range.

Retain protected host bindings and never-admitted reservations while returning independent active, prospective accepted and dormant maps. Add interval-boundary, provenance, explicit runtime account, invalid-input and output-ownership tests. Public mapped execution remains inhibited; this planner performs no host, state or engine effects.

Compile a pure execution-map plan from immutable D identity evidence and separately supplied reservation and admission history. Exact maps project all declared identities and reject unexplained surplus; bounded maps preserve their complete accepted range. Retain protected host bindings and never-admitted reservations while returning independent active, prospective accepted and dormant maps. Add interval-boundary, provenance, explicit runtime account, invalid-input and output-ownership tests. Public mapped execution remains inhibited; this planner performs no host, state or engine effects.

gitar-bot · 2026-10-28T13:28:18Z

Code Review ✅ Approved

🟡 Medium risk · The pure planner partitions UID/GID bindings; incorrect maps could misassign identities if consumed, while public mapped execution remains inhibited.

Adds a pure execution-map planner that compiles identity closure and active, accepted, and dormant maps from D identity evidence and reservation/admission history, with no host, state, or engine effects. No issues found.

Verification

Rules No rules evaluated

Functional validation Not enabled

Set up

_{For more verification details, comment gitar display:verbose.}

Options

Auto-apply is off → Gitar will not commit updates to this branch.
Display: compact → Showing compact verification results.

Comment with these commands to change the behavior for this request:

`Auto-apply`	`Compact`
`gitar auto-apply:on`	`gitar display:verbose`

_{Was this helpful? React with 👍 / 👎 | Powered by Gitar — free for open source}

omry · 2026-10-28T13:33:07Z

PR-cycle state — maintained automatically. Do not edit by hand.

Mechanical PR-cycle state (JSON)

{
  "approval": {
    "candidate_revision_fingerprint": "sha256:cac9c7be2f1bdecdd116afb5885102f0813ccb479452e997195e5aa2ff97c585",
    "evidence": {
      "attestations": [],
      "candidate_revision_fingerprint": "sha256:cac9c7be2f1bdecdd116afb5885102f0813ccb479452e997195e5aa2ff97c585",
      "check_conclusions": [
        {
          "conclusion": "SUCCESS",
          "name": "Bash native evidence checks",
          "run_id": 122859220840
        },
        {
          "conclusion": "SUCCESS",
          "name": "Gitar",
          "run_id": 122844773352
        },
        {
          "conclusion": "SUCCESS",
          "name": "Linux CI checks",
          "run_id": 122857077661
        },
        {
          "conclusion": "SUCCESS",
          "name": "Target smoke (darwin-amd64)",
          "run_id": 122857136621
        },
        {
          "conclusion": "SUCCESS",
          "name": "Target smoke (darwin-arm64)",
          "run_id": 122857077203
        },
        {
          "conclusion": "SUCCESS",
          "name": "Target smoke (linux-amd64)",
          "run_id": 122857157990
        },
        {
          "conclusion": "SUCCESS",
          "name": "Target smoke (linux-arm64)",
          "run_id": 122857078167
        },
        {
          "conclusion": "SUCCESS",
          "name": "Windows host smoke (windows-amd64)",
          "run_id": 122857079048
        },
        {
          "conclusion": "SUCCESS",
          "name": "Windows host smoke (windows-arm64)",
          "run_id": 122857079177
        }
      ],
      "delivery_deferral_ledger_digest": "sha256:4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945",
      "finding_dispositions_digest": "sha256:4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945",
      "operation_identity": "sha256:d0fd6e0080a2728c2c72516cb7eb8b13d41d35fc199763900db9619c7f4d8785",
      "review_request": {
        "body_digest": "sha256:863c27963afeea52bc38388436477442a3316f600f55db69dcd623356a3e29a4",
        "id": 6470500639
      },
      "review_result": {
        "body_digest": "sha256:a87e0b77308d8e9a5d387c06248f24a271c113cf29d48716f9d49d88f6420a3a",
        "id": 6470529500
      }
    },
    "evidence_fingerprint": "sha256:1f5359a5470515054e71dac9bf7a31b3721dc53b75f60171fa0f994459c7458d",
    "head_sha": "3d7a3c718ca49228b0a1e55942f7525655e6573e",
    "operation_identity": "sha256:d0fd6e0080a2728c2c72516cb7eb8b13d41d35fc199763900db9619c7f4d8785",
    "review_request_id": 6470500639,
    "review_result_id": 6470529500,
    "status": "approved-evidence-recorded"
  },
  "candidate_revision_fingerprint": "sha256:cac9c7be2f1bdecdd116afb5885102f0813ccb479452e997195e5aa2ff97c585",
  "check_conclusions": [
    {
      "conclusion": "SUCCESS",
      "name": "Bash native evidence checks",
      "run_id": 122859220840
    },
    {
      "conclusion": "SUCCESS",
      "name": "Gitar",
      "run_id": 122844773352
    },
    {
      "conclusion": "SUCCESS",
      "name": "Linux CI checks",
      "run_id": 122857077661
    },
    {
      "conclusion": "SUCCESS",
      "name": "Target smoke (darwin-amd64)",
      "run_id": 122857136621
    },
    {
      "conclusion": "SUCCESS",
      "name": "Target smoke (darwin-arm64)",
      "run_id": 122857077203
    },
    {
      "conclusion": "SUCCESS",
      "name": "Target smoke (linux-amd64)",
      "run_id": 122857157990
    },
    {
      "conclusion": "SUCCESS",
      "name": "Target smoke (linux-arm64)",
      "run_id": 122857078167
    },
    {
      "conclusion": "SUCCESS",
      "name": "Windows host smoke (windows-amd64)",
      "run_id": 122857079048
    },
    {
      "conclusion": "SUCCESS",
      "name": "Windows host smoke (windows-arm64)",
      "run_id": 122857079177
    }
  ],
  "check_observations": [
    {
      "checks": [
        {
          "conclusion": "SUCCESS",
          "name": "Bash native evidence checks",
          "run_id": 122859220840,
          "run_status": "completed",
          "status": "success",
          "url": "https://github.com/omry/reploy/actions/runs/40696554221/job/122859220840"
        },
        {
          "conclusion": "SUCCESS",
          "name": "Gitar",
          "run_id": 122844773352,
          "run_status": "completed",
          "status": "success",
          "url": "https://github.com/omry/reploy/runs/122844773352"
        },
        {
          "conclusion": "SUCCESS",
          "name": "Linux CI checks",
          "run_id": 122857077661,
          "run_status": "completed",
          "status": "success",
          "url": "https://github.com/omry/reploy/actions/runs/40696554221/job/122857077661"
        },
        {
          "conclusion": "SUCCESS",
          "name": "Target smoke (darwin-amd64)",
          "run_id": 122857136621,
          "run_status": "completed",
          "status": "success",
          "url": "https://github.com/omry/reploy/actions/runs/40696554221/job/122857136621"
        },
        {
          "conclusion": "SUCCESS",
          "name": "Target smoke (darwin-arm64)",
          "run_id": 122857077203,
          "run_status": "completed",
          "status": "success",
          "url": "https://github.com/omry/reploy/actions/runs/40696554221/job/122857077203"
        },
        {
          "conclusion": "SUCCESS",
          "name": "Target smoke (linux-amd64)",
          "run_id": 122857157990,
          "run_status": "completed",
          "status": "success",
          "url": "https://github.com/omry/reploy/actions/runs/40696554221/job/122857157990"
        },
        {
          "conclusion": "SUCCESS",
          "name": "Target smoke (linux-arm64)",
          "run_id": 122857078167,
          "run_status": "completed",
          "status": "success",
          "url": "https://github.com/omry/reploy/actions/runs/40696554221/job/122857078167"
        },
        {
          "conclusion": "SUCCESS",
          "name": "Windows host smoke (windows-amd64)",
          "run_id": 122857079048,
          "run_status": "completed",
          "status": "success",
          "url": "https://github.com/omry/reploy/actions/runs/40696554221/job/122857079048"
        },
        {
          "conclusion": "SUCCESS",
          "name": "Windows host smoke (windows-arm64)",
          "run_id": 122857079177,
          "run_status": "completed",
          "status": "success",
          "url": "https://github.com/omry/reploy/actions/runs/40696554221/job/122857079177"
        }
      ],
      "head_sha": "3d7a3c718ca49228b0a1e55942f7525655e6573e",
      "id": "sha256:299d65342cc2731e42e1b1d3cdd4b11129312bd689c9e31b5d72b6b93efd3423",
      "required_checks": [
        "Bash native evidence checks",
        "Gitar",
        "Linux CI checks",
        "Target smoke (darwin-amd64)",
        "Target smoke (darwin-arm64)",
        "Target smoke (linux-amd64)",
        "Target smoke (linux-arm64)",
        "Windows host smoke (windows-amd64)",
        "Windows host smoke (windows-arm64)"
      ],
      "status": "success"
    },
    {
      "checks": [
        {
          "conclusion": "SKIPPED",
          "name": "Bash native evidence checks",
          "run_id": 122855307945,
          "run_status": "completed",
          "status": "failure",
          "url": "https://github.com/omry/reploy/actions/runs/40696554221/job/122855307945"
        },
        {
          "conclusion": "SUCCESS",
          "name": "Gitar",
          "run_id": 122844773352,
          "run_status": "completed",
          "status": "success",
          "url": "https://github.com/omry/reploy/runs/122844773352"
        },
        {
          "conclusion": "SUCCESS",
          "name": "Linux CI checks",
          "run_id": 122857077661,
          "run_status": "completed",
          "status": "success",
          "url": "https://github.com/omry/reploy/actions/runs/40696554221/job/122857077661"
        },
        {
          "conclusion": "SUCCESS",
          "name": "Target smoke (darwin-amd64)",
          "run_id": 122857136621,
          "run_status": "completed",
          "status": "success",
          "url": "https://github.com/omry/reploy/actions/runs/40696554221/job/122857136621"
        },
        {
          "name": "Target smoke (darwin-arm64)",
          "run_id": 122857077203,
          "run_status": "in_progress",
          "status": "pending",
          "url": "https://github.com/omry/reploy/actions/runs/40696554221/job/122857077203"
        },
        {
          "conclusion": "SUCCESS",
          "name": "Target smoke (linux-amd64)",
          "run_id": 122857157990,
          "run_status": "completed",
          "status": "success",
          "url": "https://github.com/omry/reploy/actions/runs/40696554221/job/122857157990"
        },
        {
          "conclusion": "SUCCESS",
          "name": "Target smoke (linux-arm64)",
          "run_id": 122857078167,
          "run_status": "completed",
          "status": "success",
          "url": "https://github.com/omry/reploy/actions/runs/40696554221/job/122857078167"
        },
        {
          "conclusion": "SUCCESS",
          "name": "Windows host smoke (windows-amd64)",
          "run_id": 122857079048,
          "run_status": "completed",
          "status": "success",
          "url": "https://github.com/omry/reploy/actions/runs/40696554221/job/122857079048"
        },
        {
          "conclusion": "SUCCESS",
          "name": "Windows host smoke (windows-arm64)",
          "run_id": 122857079177,
          "run_status": "completed",
          "status": "success",
          "url": "https://github.com/omry/reploy/actions/runs/40696554221/job/122857079177"
        }
      ],
      "head_sha": "3d7a3c718ca49228b0a1e55942f7525655e6573e",
      "id": "sha256:760e81334df6c4bdf0842a28b6693633313df20ea5d964d8b1e47702e1fbb0ed",
      "required_checks": [
        "Bash native evidence checks",
        "Gitar",
        "Linux CI checks",
        "Target smoke (darwin-amd64)",
        "Target smoke (darwin-arm64)",
        "Target smoke (linux-amd64)",
        "Target smoke (linux-arm64)",
        "Windows host smoke (windows-amd64)",
        "Windows host smoke (windows-arm64)"
      ],
      "status": "failure"
    },
    {
      "checks": [
        {
          "name": "Bash native evidence checks",
          "reason": "missing",
          "status": "pending"
        },
        {
          "conclusion": "SUCCESS",
          "name": "Gitar",
          "run_id": 122844773352,
          "run_status": "completed",
          "status": "success",
          "url": "https://github.com/omry/reploy/runs/122844773352"
        },
        {
          "name": "Linux CI checks",
          "run_id": 122844752064,
          "run_status": "in_progress",
          "status": "pending",
          "url": "https://github.com/omry/reploy/actions/runs/40696554221/job/122844752064"
        },
        {
          "conclusion": "SUCCESS",
          "name": "Target smoke (darwin-amd64)",
          "run_id": 122844752175,
          "run_status": "completed",
          "status": "success",
          "url": "https://github.com/omry/reploy/actions/runs/40696554221/job/122844752175"
        },
        {
          "conclusion": "FAILURE",
          "name": "Target smoke (darwin-arm64)",
          "run_id": 122844751715,
          "run_status": "completed",
          "status": "failure",
          "url": "https://github.com/omry/reploy/actions/runs/40696554221/job/122844751715"
        },
        {
          "conclusion": "SUCCESS",
          "name": "Target smoke (linux-amd64)",
          "run_id": 122844751743,
          "run_status": "completed",
          "status": "success",
          "url": "https://github.com/omry/reploy/actions/runs/40696554221/job/122844751743"
        },
        {
          "conclusion": "SUCCESS",
          "name": "Target smoke (linux-arm64)",
          "run_id": 122844751475,
          "run_status": "completed",
          "status": "success",
          "url": "https://github.com/omry/reploy/actions/runs/40696554221/job/122844751475"
        },
        {
          "conclusion": "SUCCESS",
          "name": "Windows host smoke (windows-amd64)",
          "run_id": 122844751922,
          "run_status": "completed",
          "status": "success",
          "url": "https://github.com/omry/reploy/actions/runs/40696554221/job/122844751922"
        },
        {
          "conclusion": "SUCCESS",
          "name": "Windows host smoke (windows-arm64)",
          "run_id": 122844751990,
          "run_status": "completed",
          "status": "success",
          "url": "https://github.com/omry/reploy/actions/runs/40696554221/job/122844751990"
        }
      ],
      "head_sha": "3d7a3c718ca49228b0a1e55942f7525655e6573e",
      "id": "sha256:a74bfe04cc37e03547be29d2a67029302d9d8d293b507935bfa750ee9064bb49",
      "required_checks": [
        "Bash native evidence checks",
        "Gitar",
        "Linux CI checks",
        "Target smoke (darwin-amd64)",
        "Target smoke (darwin-arm64)",
        "Target smoke (linux-amd64)",
        "Target smoke (linux-arm64)",
        "Windows host smoke (windows-amd64)",
        "Windows host smoke (windows-arm64)"
      ],
      "status": "failure"
    }
  ],
  "delivery_deferral_ledger_digest": "sha256:4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945",
  "delivery_deferrals": [],
  "findings": [],
  "pr": {
    "base_ref": "pr296",
    "base_sha": "26ff3513eb21f7912c1e6acfc849995d93e8f19c",
    "body_digest": "sha256:ef040ca9b8de16bd64ba35109f67f5d6fce04e18011e7f91f15635566ac0b5db",
    "body_identity_version": 2,
    "diff_digest": "sha256:f37fa4d9398d2465cac32c8426f60d76bfa1ae390c4cfe0feeadae4c62f52a92",
    "head_ref": "pr297",
    "head_sha": "3d7a3c718ca49228b0a1e55942f7525655e6573e",
    "pr": 298,
    "repository": "omry/reploy",
    "scope_authority": [
      {
        "digest": "sha256:36b1a52fb29e6424a689b1e2cae7e023371f878ca586f056fc28bc50450b87e6",
        "path": ".github/workflows/ci.yml"
      },
      {
        "digest": "sha256:fc49790f85e6d5fae77e8c91b479d0ad1fe4b3f1699e24df821db73aa75b779e",
        "path": "AGENTS.md"
      },
      {
        "digest": "sha256:078e63e84d432c2aad03120ca30e40ec4572a8970e6bf6be9d5008608a30f435",
        "path": "docs/MULTI_IDENTITY_D_DESIGN.md"
      },
      {
        "digest": "sha256:ab5e9be8075947bc37c863545efb1959fa7aca886226018729bfeff6f7032e1e",
        "path": "docs/MULTI_IDENTITY_E_DESIGN.md"
      },
      {
        "digest": "sha256:3ef44a7a0be43648f5df1faad39b16101978662c58c87d6fa8e7409093a58fe9",
        "path": "docs/MULTI_IDENTITY_IMPLEMENTATION_PLAN.md"
      },
      {
        "digest": "sha256:fe188bb8a80f7f235e99b023283749a3a9e3172e4adf70b70b495d80e50e9218",
        "path": "docs/MULTI_IDENTITY_MAIL_RECONCILIATION.md"
      },
      {
        "digest": "sha256:b049714f4a85d0f3fb204615897374377690564627bfcdd03e50c945fb042826",
        "path": "docs/MULTI_IDENTITY_SECURITY_CONTRACT.md"
      }
    ],
    "title_digest": "sha256:7efbd41dc73a1203f1849053b33a285625f88cfa76c0d16c7871e554527cb290"
  },
  "record_version": 6,
  "review_observations": [],
  "review_requests": [
    {
      "base_established_at": "2026-10-28T13:27:14Z",
      "base_ref": "pr296",
      "base_sha": "26ff3513eb21f7912c1e6acfc849995d93e8f19c",
      "body_digest": "sha256:863c27963afeea52bc38388436477442a3316f600f55db69dcd623356a3e29a4",
      "created_at": "2026-10-28T13:37:56Z",
      "head_sha": "3d7a3c718ca49228b0a1e55942f7525655e6573e",
      "id": 6470500639,
      "kind": "regular-review"
    }
  ],
  "review_results": [
    {
      "base_ref": "pr296",
      "base_sha": "26ff3513eb21f7912c1e6acfc849995d93e8f19c",
      "body_digest": "sha256:a87e0b77308d8e9a5d387c06248f24a271c113cf29d48716f9d49d88f6420a3a",
      "commit_id": "3d7a3c718ca49228b0a1e55942f7525655e6573e",
      "id": 6470529500,
      "inline_message_ids": [],
      "request_comment_id": 6470500639,
      "result_kind": "clean",
      "status": "result",
      "submitted_at": "2026-10-28T13:39:09Z",
      "unresolved_thread_ids": []
    }
  ],
  "revision_fingerprint": "sha256:cac9c7be2f1bdecdd116afb5885102f0813ccb479452e997195e5aa2ff97c585",
  "rounds": [
    {
      "applied_fix_paths": [],
      "disposition_changes": [],
      "effective_diff_digest": "sha256:f37fa4d9398d2465cac32c8426f60d76bfa1ae390c4cfe0feeadae4c62f52a92",
      "finding_ids": [],
      "invariants": [
        "Exact execution maps contain only current declared identities or independently proven prior admission; protected reservations alone do not authorize surplus.",
        "Retain all protected affine host bindings and preserve bounded whole-range authority.",
        "Public mapped execution remains inhibited; E1.1 has no host/engine/state effects.",
        "Every exact-head ci.yml job succeeds before approval."
      ],
      "outcome": "clean",
      "proposed_fix_paths": [],
      "resulting_head": "3d7a3c718ca49228b0a1e55942f7525655e6573e",
      "review_observation_id": null,
      "review_request_id": 6470500639,
      "review_result_id": 6470529500,
      "reviewed_head": "3d7a3c718ca49228b0a1e55942f7525655e6573e",
      "root_cause": "No current-slice defect or correction. Existing 100ms CI fixture failure and a local aggregate test timeout were retained; unchanged-head rerun and full-profile retry passed.",
      "round": 1,
      "unresolved_current_slice_findings": 0,
      "unresolved_design_blockers": 0
    }
  ],
  "schema": "awd:swe:pr-cycle-state",
  "version": 2
}

chatgpt-codex-connector · 2026-10-28T13:34:33Z

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-28T13:39:10.649150Z	`3d7a3c7`	Manual request
🔒 Security Review	✅ Completed 2026-10-28T13:36:33.414312Z	`3d7a3c7`	Draft marked ready

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

omry · 2026-10-28T13:37:56Z

@codex review

Exact head: 3d7a3c7

chatgpt-codex-connector · 2026-10-28T13:39:09Z

Codex Review: Didn't find any major issues. 🚀

Reviewed commit: 3d7a3c718c

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

omry changed the base branch from main to pr296 October 28, 2026 13:27

omry added this pull request to stack #297 October 28, 2026 13:27

omry marked this pull request as ready for review October 28, 2026 13:34

omry added the approved PR reviewed and approved label Oct 28, 2026

omry merged commit 6031430 into main Oct 30, 2026
16 of 17 checks passed

omry deleted the pr297 branch October 30, 2026 05:47

Navigation Menu

Repository navigation

E1.1: compile execution identity closure and active maps - #298

E1.1: compile execution identity closure and active maps#298
omry merged 1 commit into
pr296from
pr297

omry commented Oct 28, 2026 •

edited

Loading

Uh oh!

gitar-bot Bot commented Oct 28, 2026 •

edited

Loading

Uh oh!

omry commented Oct 28, 2026 •

edited

Loading

Uh oh!

chatgpt-codex-connector Bot commented Oct 28, 2026 •

edited

Loading

Uh oh!

omry commented Oct 28, 2026

Uh oh!

chatgpt-codex-connector Bot commented Oct 28, 2026

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

omry commented Oct 28, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

gitar-bot Bot commented Oct 28, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

omry commented Oct 28, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

chatgpt-codex-connector Bot commented Oct 28, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codex Review Summary

Uh oh!

omry commented Oct 28, 2026

Uh oh!

chatgpt-codex-connector Bot commented Oct 28, 2026

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

omry commented Oct 28, 2026 •

edited

Loading

gitar-bot Bot commented Oct 28, 2026 •

edited

Loading

omry commented Oct 28, 2026 •

edited

Loading

chatgpt-codex-connector Bot commented Oct 28, 2026 •

edited

Loading