Repository navigation
fix(policy): deny uninspectable ancestors and verify configured releases - #4
Conversation
…eleases Co-authored-by: Medulla <medulla@tinyhumans.ai>
|
You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard. |
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info
📝 Walkthrough
Merge Risk | ⚪ Minimal · up to
|
| Check name | Status | Explanation | Resolution |
|---|---|---|---|
| Docstring Coverage |  |
Docstring coverage is 66.67% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 6 functions across 2 files. (2 skipped: 2… | Write docstrings for the functions missing them to satisfy the coverage threshold. |
✅ Passed checks (4 passed)
-
Check name Status Explanation Description Check Check skipped - CodeRabbit’s high-level summary is enabled. Title check The title clearly identifies both main changes: failing closed for uninspectable ancestors and verifying configured releases. Linked Issues check Check skipped because no linked issues were found for this pull request. Out of Scope Changes check Check skipped because no linked issues were found for this pull request.
Full details: Docstring Coverage
-
Explanation
Docstring coverage is 66.67% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 6 functions across 2 files. (2 skipped: 2 unsupported.)
- Fix all pre-merge checks with AI
✨ Finishing Touches 💡 1
-
📝 Generate docstrings 💡
-
- Commit to this branch
- Create a new PR
-
- Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts
I’m a rabbit with a checklist neat,
I hop through paths on careful feet.
Symlink roots now join the scope,
Missing paths still leave a trace of hope.
A release check gets a new way,
Then I nibble clover to end the day.
Comment @coderabbitai help to get the list of available commands.
Tiny Sweeper reviewTiny Sweeper reviewed this change across 6 lane(s) and found 1 active actionable finding(s). Detailed lane evidence and any incomplete work are listed below. State: Ready for maintainer review Review snapshot
Completeness: Complete What changedThe review could not produce a supported behavioral summary; inspect the cited changed surface and lane details below. FeaturesNone identified with supported citations. TestsNo supported feature-to-test mapping was produced. Test execution is not inferred. FindingsNo active actionable findings. Resolved this pass
Before mergeNone. Agent review detailscritique
security
tests
commits
description
e2e
Evidence and run details
|
![tinysweeper[bot]](https://avatars.githubusercontent.com/in/4526585?s=60&v=4){kind=small}
There was a problem hiding this comment.
Requesting changes: 1 lane(s) blocking, worst finding is high.
Fix or reply to the findings below and push. The next review clears this automatically once they are gone — you should not need to dismiss anything by hand.
$0.0107 · 137,514 in / 11,334 out · 18,004 cached (13%) · gpt-5.6-luna, glm-5.3-flash
critique: $0.0068 · 79,548 in / 6,807 out · 10,864 cached (14%) · gpt-5.6-luna, glm-5.3-flash
security: $0.0038 · 45,626 in / 2,338 out · 5,476 cached (12%) · gpt-5.6-luna
tests: $0.0001 · 4,751 in / 1,111 out · 64 cached (1%) · glm-5.3-flash
description: $0.0000 · 4,390 in / 108 out · 1,472 cached (34%) · glm-5.3-flash
Co-authored-by: Medulla <medulla@tinyhumans.ai>
There was a problem hiding this comment.
The previously-blocking findings are resolved. Clearing the changes request.
$0.0005 · 24,004 in / 2,325 out · 3,328 cached (14%) · gpt-5.6-luna, glm-5.3-flash
critique: $0.0004 · 3,881 in / 254 out · 0 cached (0%) · gpt-5.6-luna
tests: $0.0001 · 11,527 in / 1,030 out · 3,136 cached (27%) · glm-5.3-flash
description: $0.0000 · 5,025 in / 112 out · 64 cached (1%) · glm-5.3-flash
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
1 participant
Ancestor resolution treated non-NotFound metadata failures as missing components after canonicalization returned NotFound. It now propagates permission and other inspection errors instead of reconstructing an authorized prospective path. Canonical forbidden-root aliases containing the workspace also preserve the documented workspace precedence; narrower forbidden subtrees remain denied.
Both behavior regressions failed before the fixes and pass afterward. Validation: 152 Linux tests plus the constructor compile-fail doctest, full all-features build, Clippy with warnings denied, formatting, native loader verification, and every production source file above 90% line coverage.
The v0.2.2 release bundles passed every platform's native verifier, but the final generic loader invoked the module with
{}, which is intentionally invalid initialization configuration. The release workflow now uses TinySecurity's existing configured verifier over the same GitHub archive/digest loader; it also exercises actual policy calls and SDK reinitialization. That verifier successfully loaded the published v0.2.2 archive, while the failing generic invocation is recorded in release run 38077126471. No configuration validation or policy checks are relaxed.Follow-up to #3 and OpenHuman issue tinyhumansai/openhuman#7328. OpenHuman's migration remains in tinyhumansai/openhuman#7331; these policy fixes need merging and a new published release before the host ships them.
Summary by CodeRabbit