fix(lifecycle): bind deletion receipts to immutable identity - #353
fix(lifecycle): bind deletion receipts to immutable identity#353seonghobae wants to merge 10 commits into
Conversation
|
Important Review available on request
Reviews should be triggered manually for repositories with fewer than 10 stars. Select Trigger review above or comment ⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Plus Run ID: No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Plus Run ID: 📒 Files selected for processing (2)
🚧 Files skipped from review as they are similar to previous changes (1)
📝 WalkthroughWalkthrough삭제 영속성 요청의 식별 정보를 담는 불변 record를 추가했다. 필수값, 텍스트 정규화와 길이, lowercase SHA-256 형식을 검증한다. 생성 결과와 예외 조건을 JUnit 테스트로 검증한다. Changes삭제 영속성 식별자
Estimated code review effort: 3 (Moderate) | ~20 minutes 🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In
`@src/main/java/com/clearfolio/viewer/lifecycle/ArtifactDeletionReceiptIdentity.java`:
- Around line 51-57: Update requireSha256 in ArtifactDeletionReceiptIdentity to
validate the original artifactChecksum without stripping whitespace, while still
rejecting null, blank, and any value that is not exactly a 64-character
lowercase SHA-256 digest. Add a regression case to
ArtifactDeletionReceiptIdentityTest asserting that leading or trailing
whitespace causes validation to fail.
🪄 Autofix
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro Plus
Run ID: 66fc97c8-16f9-4ef4-9fb0-51bafcd4f693
📒 Files selected for processing (2)
src/main/java/com/clearfolio/viewer/lifecycle/ArtifactDeletionReceiptIdentity.javasrc/test/java/com/clearfolio/viewer/lifecycle/ArtifactDeletionReceiptIdentityTest.java
|
@opencode-agent review Review exact head Review read-only; preserve independent reviewer identity. Do not persist or wire this primitive, mutate the branch, synthesize author approval, weaken protection, or merge. |
🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
expected='8fc34f5e4cf61a328e3a877f731aa8fc55ff792e'
actual="$(git rev-parse HEAD)"
printf 'HEAD=%s\nEXPECTED=%s\n' "$actual" "$expected"
git diff --check "${expected}^" "$expected"
git diff --stat "${expected}^" "$expected"
git diff --unified=80 "${expected}^" "$expected" -- \
src/main/java/com/clearfolio/viewer/lifecycle/ArtifactDeletionReceiptIdentity.java \
src/test/java/com/clearfolio/viewer/lifecycle/ArtifactDeletionReceiptIdentityTest.java
ast-grep outline src/main/java/com/clearfolio/viewer/lifecycle/ArtifactDeletionReceiptIdentity.java \
--items all --view expanded
ast-grep outline src/test/java/com/clearfolio/viewer/lifecycle/ArtifactDeletionReceiptIdentityTest.java \
--items all --view expandedLength of output: 1931 🏁 Script executed: #!/bin/bash
set -euo pipefail
printf '%s\n' '--- PR metadata ---'
gh pr view 353 --repo ContextualWisdomLab/clearfolio \
--json number,baseRefName,baseRefOid,headRefName,headRefOid,commits \
--jq '{number, baseRefName, baseRefOid, headRefName, headRefOid, commits: [.commits[] | {oid, messageHeadline}]}'
printf '%s\n' '--- commits after merge base with base branch ---'
base_ref="$(gh pr view 353 --repo ContextualWisdomLab/clearfolio --json baseRefName --jq .baseRefName)"
merge_base="$(git merge-base HEAD "origin/${base_ref}")"
printf 'BASE_REF=%s\nMERGE_BASE=%s\n' "$base_ref" "$merge_base"
git log --oneline "${merge_base}..HEAD"
printf '%s\n' '--- identity record ---'
nl -ba src/main/java/com/clearfolio/viewer/lifecycle/ArtifactDeletionReceiptIdentity.java
printf '%s\n' '--- identity tests ---'
nl -ba src/test/java/com/clearfolio/viewer/lifecycle/ArtifactDeletionReceiptIdentityTest.java
printf '%s\n' '--- identity changes in PR range ---'
git diff --check "${merge_base}..HEAD"
git diff --unified=30 "${merge_base}..HEAD" -- \
src/main/java/com/clearfolio/viewer/lifecycle/ArtifactDeletionReceiptIdentity.java \
src/test/java/com/clearfolio/viewer/lifecycle/ArtifactDeletionReceiptIdentityTest.javaLength of output: 3392 🏁 Script executed: #!/bin/bash
set -euo pipefail
base='eb0a32e87e7470469c8fa0f8c67d9583654bef57'
head='8fc34f5e4cf61a328e3a877f731aa8fc55ff792e'
print_numbered() {
awk '{printf "%6d\t%s\n", NR, $0}' "$1"
}
printf '%s\n' '--- production identity record ---'
print_numbered src/main/java/com/clearfolio/viewer/lifecycle/ArtifactDeletionReceiptIdentity.java
printf '%s\n' '--- identity tests ---'
print_numbered src/test/java/com/clearfolio/viewer/lifecycle/ArtifactDeletionReceiptIdentityTest.java
printf '%s\n' '--- exact PR-range identity diff ---'
git diff --check "${base}..${head}"
git diff --unified=40 "${base}..${head}" -- \
src/main/java/com/clearfolio/viewer/lifecycle/ArtifactDeletionReceiptIdentity.java \
src/test/java/com/clearfolio/viewer/lifecycle/ArtifactDeletionReceiptIdentityTest.java
printf '%s\n' '--- related lifecycle identity constructors and SHA-256 validation ---'
rg -n -C 4 --glob '*.java' \
'(ArtifactDeletionReceiptIdentity\s*\(|SHA-256|artifactChecksum|auditCorrelationId|requestedAt)' \
src/main/java src/test/javaLength of output: 78609 🏁 Script executed: #!/bin/bash
set -euo pipefail
repo='ContextualWisdomLab/clearfolio'
pr='353'
head='8fc34f5e4cf61a328e3a877f731aa8fc55ff792e'
printf '%s\n' '--- files reported by GitHub for the PR ---'
gh api --paginate "repos/${repo}/pulls/${pr}/files?per_page=100" \
--jq '.[] | [.filename, .status, .additions, .deletions] | `@tsv`'
printf '%s\n' '--- complete local PR-range name-status ---'
git diff --name-status 'eb0a32e87e7470469c8fa0f8c67d9583654bef57..8fc34f5e4cf61a328e3a877f731aa8fc55ff792e'
printf '%s\n' '--- check runs attached to the requested head ---'
gh api "repos/${repo}/commits/${head}/check-runs?per_page=100" \
--jq '.check_runs[] | [.name, .status, .conclusion] | `@tsv`'Length of output: 2575
No findings.
The PR contains only the production record and its tests. The exact-head Maven, coverage, security, SAST, and fuzz checks report success. No branch changes, persistence wiring, approval, protection changes, or merge actions were performed.
|
Pull request was converted to draft
|
Exact-current-head independent review request for Freshly rechecked: CI, Security Scan, SAST Semgrep, and fuzz are terminal-success; mergeable is true; the only inline finding is resolved and outdated. This two-file value-object slice binds deletion authority and an exact canonical lowercase SHA-256 digest; it does not claim durable receipt persistence. Review this exact head only. @coderabbitai review |
|
Tip For best results, initiate chat on the files or code changes. 🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
base='eb0a32e87e7470469c8fa0f8c67d9583654bef57'
head='8fc34f5e4cf61a328e3a877f731aa8fc55ff792e'
repo='ContextualWisdomLab/clearfolio'
printf '%s\n' '--- exact revision ---'
printf 'HEAD=%s\nREQUESTED_HEAD=%s\n' "$(git rev-parse HEAD)" "$head"
git cat-file -e "${base}^{commit}"
git cat-file -e "${head}^{commit}"
printf '%s\n' '--- changed files and whitespace check ---'
git diff --check "${base}..${head}"
git diff --name-status "${base}..${head}"
git diff --stat "${base}..${head}"
printf '%s\n' '--- exact diff ---'
git diff --unified=80 "${base}..${head}" -- \
src/main/java/com/clearfolio/viewer/lifecycle/ArtifactDeletionReceiptIdentity.java \
src/test/java/com/clearfolio/viewer/lifecycle/ArtifactDeletionReceiptIdentityTest.java
printf '%s\n' '--- production structure and source ---'
ast-grep outline src/main/java/com/clearfolio/viewer/lifecycle/ArtifactDeletionReceiptIdentity.java --items all --view expanded
nl -ba src/main/java/com/clearfolio/viewer/lifecycle/ArtifactDeletionReceiptIdentity.java
printf '%s\n' '--- test structure and source ---'
ast-grep outline src/test/java/com/clearfolio/viewer/lifecycle/ArtifactDeletionReceiptIdentityTest.java --items all --view expanded
nl -ba src/test/java/com/clearfolio/viewer/lifecycle/ArtifactDeletionReceiptIdentityTest.java
printf '%s\n' '--- related validation conventions ---'
rg -n -C 3 --glob '*.java' \
'(SHA-256|artifactChecksum|auditCorrelationId|requestedAt|isBlank\(\)|trim\(\)|[0-9a-f]\{64\})' \
src/main/java/com/clearfolio/viewer/lifecycle src/test/java/com/clearfolio/viewer/lifecycle || true
printf '%s\n' '--- PR metadata and requested-head checks ---'
gh pr view 353 --repo "$repo" \
--json headRefOid,baseRefOid,mergeable,state,isDraft \
--jq '{headRefOid, baseRefOid, mergeable, state, isDraft}'
gh api "repos/${repo}/commits/${head}/check-runs?per_page=100" \
--jq '.check_runs[] | [.name, .status, .conclusion] | `@tsv`'Length of output: 13101 🏁 Script executed: #!/bin/bash
set -euo pipefail
base='eb0a32e87e7470469c8fa0f8c67d9583654bef57'
head='8fc34f5e4cf61a328e3a877f731aa8fc55ff792e'
repo='ContextualWisdomLab/clearfolio'
printf '%s\n' '--- GitHub PR revision state ---'
gh pr view 353 --repo "$repo" \
--json number,headRefOid,baseRefOid,mergeable,state,isDraft \
--jq '{number, headRefOid, baseRefOid, mergeable, state, isDraft}'
printf '%s\n' '--- requested commit metadata ---'
gh api "repos/${repo}/commits/${head}" \
--jq '{sha, parents: [.parents[].sha], message: .commit.message}'
printf '%s\n' '--- checks attached to requested commit ---'
gh api "repos/${repo}/commits/${head}/check-runs?per_page=100" \
--jq '.check_runs[] | [.name, .status, .conclusion] | `@tsv`'
printf '%s\n' '--- exact commit source objects ---'
git show "${head}:src/main/java/com/clearfolio/viewer/lifecycle/ArtifactDeletionReceiptIdentity.java" |
sed -n '=' | sed 'N;s/\n/\t/'
printf '%s\n' '--- exact commit test objects ---'
git show "${head}:src/test/java/com/clearfolio/viewer/lifecycle/ArtifactDeletionReceiptIdentityTest.java" |
sed -n '=' | sed 'N;s/\n/\t/'
printf '%s\n' '--- exact range completeness ---'
git diff --check "${base}..${head}"
git diff --name-only "${base}..${head}"Length of output: 4025
GitHub reports that PR For the requested historical range, I verified these facts:
I did not issue a review verdict for the current PR because the current head differs from the requested commit. Please request review for You are interacting with an AI system. |
|
Queued @opencode-agent ; Already queued @cwl-noema-review on this exact request for PR #353 at head |
|
Queued @opencode-agent ; Already queued @cwl-noema-review on this exact request for PR #353 at head |
|
Already queued @cwl-noema-review and @opencode-agent on this exact request for PR #353 at head |
|
Already queued @cwl-noema-review and @opencode-agent on this exact request for PR #353 at head |
|
Already queued @cwl-noema-review and @opencode-agent on this exact request for PR #353 at head |
|
Already queued @cwl-noema-review and @opencode-agent on this exact request for PR #353 at head |
|
Already queued @cwl-noema-review and @opencode-agent on this exact request for PR #353 at head |
|
Already queued @cwl-noema-review and @opencode-agent on this exact request for PR #353 at head |
|
Already queued @cwl-noema-review and @opencode-agent on this exact request for PR #353 at head |
|
Already queued @cwl-noema-review and @opencode-agent on this exact request for PR #353 at head |
|
Already queued @cwl-noema-review and @opencode-agent on this exact request for PR #353 at head |
|
Already queued @cwl-noema-review and @opencode-agent on this exact request for PR #353 at head |
|
Already queued @cwl-noema-review and @opencode-agent on this exact request for PR #353 at head |
|
Already queued @cwl-noema-review and @opencode-agent on this exact request for PR #353 at head |
|
Already queued @cwl-noema-review and @opencode-agent on this exact request for PR #353 at head |
|
Already queued @cwl-noema-review and @opencode-agent on this exact request for PR #353 at head |
|
Already queued @cwl-noema-review and @opencode-agent on this exact request for PR #353 at head |
|
Already queued @cwl-noema-review and @opencode-agent on this exact request for PR #353 at head |
|
Already queued @cwl-noema-review and @opencode-agent on this exact request for PR #353 at head |
|
Already queued @cwl-noema-review and @opencode-agent on this exact request for PR #353 at head |
|
Already queued @cwl-noema-review and @opencode-agent on this exact request for PR #353 at head |
|
Already queued @cwl-noema-review and @opencode-agent on this exact request for PR #353 at head |
1 participant
Objective
Advance issue #263 with an immutable deletion-receipt identity that cannot accept absent authority or a non-canonical artifact digest.
Exact current-head evidence
eb0a32e87e7470469c8fa0f8c67d9583654bef57;8fc34f5e4cf61a328e3a877f731aa8fc55ff792e;ArtifactDeletionReceiptIdentity.javaand its focused regression only;Identity contract
The immutable identity binds one deletion request UUID to normalized bounded tenant and audit identifiers, exact job UUID, request time, and a byte-exact canonical lowercase 64-character SHA-256 artifact digest. Null, blank, control-corrupted, overlong, uppercase, malformed, or whitespace-padded authority fails closed.
Scope boundary
Value type only. This does not persist receipts, implement deletion state transitions, retry cleanup, mutate the artifact store, expose admin APIs/UI, or provide distributed locking. Issue #263 remains open for the complete tenant-safe deletion/download/recovery journey.
Merge gate
Keep this exact head unchanged. Auto-merge may act only after live required checks remain terminal-success, zero valid unresolved findings remain, and a qualifying independent non-author approval is attached to this exact head. Any head/base movement requires complete exact-head revalidation.