test(api): bind OpenAPI provenance on current main by seonghobae · Pull Request #426 · ContextualWisdomLab/clearfolio

seonghobae · 2026-08-12T23:34:02Z

Objective

Reconstruct stale PR #419's unique OpenAPI release-provenance contract directly on the current protected main, preserving its reviewed semantic delta without importing stale ancestry.

Exact current-base reconstruction

protected base immediately before this PR: 961f44a19c4ced87f8062b3ab9842a9a08d05235;
exact replacement head at creation: 3d141e749641ccf677814b636071755234611620;
the branch descends directly from that protected base with zero behind commits;
the unique delta is exactly two added standard-library files: scripts/openapi_release_provenance.py and scripts/test_openapi_release_provenance.py;
both replacement blobs are byte-identical to stale test(api): bind OpenAPI provenance on current main #419's unique blobs (f83b8749... and dd905d0b...), so no semantic work was lost while removing stale ancestry.

Scope

Release-provenance evidence only. The implementation binds exact OpenAPI bytes to one canonical lowercase 40-hex source revision, rejects missing/symlinked/non-regular/oversized contract authority, and renders canonical compact JSON. It does not modify the OpenAPI contract, controllers, DTOs, runtime version negotiation, naruon, release publication, signing infrastructure, or canonical product docs.

Merge gate

Require exact-head tests and every applicable CI/security/SAST/fuzz/package/provenance gate, zero valid unresolved findings, and the repository's qualifying independent non-author approval. Do not transfer evidence from #419 or any predecessor head.

coderabbitai · 2026-08-12T23:34:17Z

Important

Review skipped

Draft detected.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: d98fa6cb-d561-493a-a58e-2cf56480f9f0

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

🔍 Trigger review

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands.}

seonghobae · 2026-08-15T09:46:52Z

@opencode-agent review
@coderabbitai review
@cwl-noema-review review
@strix review

Review exact head 3d141e749641ccf677814b636071755234611620 only. Exact-head CI, Security Scan, and SAST Semgrep are terminal-success; fuzz is not emitted for this standard-library provenance-only path; unresolved inline findings are zero. Validate byte-exact OpenAPI hashing, canonical lowercase 40-hex source binding, regular-file/size/symlink controls, and deterministic compact JSON.

Review read-only; preserve independent reviewer identity. Do not mutate the branch, synthesize author approval, weaken protection, publish a release, or merge.

coderabbitai · 2026-08-15T09:47:43Z

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
set -euo pipefail

expected_head='3d141e749641ccf677814b636071755234611620'
expected_base='961f44a19c4ced87f8062b3ab9842a9a08d05235'

printf '%s\n' '== exact commit verification =='
actual_head="$(git rev-parse HEAD)"
actual_parent="$(git rev-parse HEAD^)"
printf 'HEAD=%s\nPARENT=%s\n' "$actual_head" "$actual_parent"
test "$actual_head" = "$expected_head"
test "$actual_parent" = "$expected_base"

printf '%s\n' '== changed paths and status =='
git diff --name-status "$expected_base" "$expected_head"
git status --short

printf '%s\n' '== file outlines =='
ast-grep outline scripts/openapi_release_provenance.py --items all
ast-grep outline scripts/test_openapi_release_provenance.py --items all

printf '%s\n' '== implementation =='
cat -n scripts/openapi_release_provenance.py

printf '%s\n' '== tests =='
cat -n scripts/test_openapi_release_provenance.py

Length of output: 1306

🏁 Script executed:

#!/bin/bash
set -euo pipefail

head='3d141e749641ccf677814b636071755234611620'
stated_base='961f44a19c4ced87f8062b3ab9842a9a08d05235'

printf '%s\n' '== ancestry =='
printf 'merge-base='
git merge-base "$stated_base" "$head"
printf '%s\n' 'stated base is ancestor of head:'
git merge-base --is-ancestor "$stated_base" "$head" && echo yes || echo no
printf '%s\n' 'commits from stated base to head:'
git rev-list --count "$stated_base..$head"
git log --format='%H %P %s' --max-count=5 "$head"

printf '%s\n' '== exact requested range =='
git diff --name-status "$stated_base" "$head"
git diff --no-ext-diff --unified=80 "$stated_base" "$head" -- \
  scripts/openapi_release_provenance.py \
  scripts/test_openapi_release_provenance.py

printf '%s\n' '== source outlines =='
ast-grep outline scripts/openapi_release_provenance.py --items all
ast-grep outline scripts/test_openapi_release_provenance.py --items all

printf '%s\n' '== implementation source =='
cat -n scripts/openapi_release_provenance.py

printf '%s\n' '== test source =='
cat -n scripts/test_openapi_release_provenance.py

printf '%s\n' '== referenced OpenAPI path candidates =='
rg -n -C2 --glob '!scripts/openapi_release_provenance.py' --glob '!scripts/test_openapi_release_provenance.py' \
  '(openapi|open-api|swagger)' README.md scripts .github 2>/dev/null || true

Length of output: 23495

🏁 Script executed:

#!/bin/bash
set -euo pipefail

printf '%s\n' '== Python test configuration candidates =='
fd -HI -t f \
  -g 'pyproject.toml' \
  -g 'pytest.ini' \
  -g 'setup.cfg' \
  -g 'tox.ini' \
  -g '.coveragerc' \
  -g 'Makefile' \
  -g 'package.json' \
  -g '*.yml' \
  -g '*.yaml' \
  .github scripts . 2>/dev/null \
  | sort -u \
  | while IFS= read -r file; do
      printf '\n--- %s ---\n' "$file"
      rg -n -i -C2 \
        '(unittest|pytest|test[_ -]?openapi|scripts/test|openapi_release_provenance|python[[:space:]].*(test|unittest))' \
        "$file" || true
    done

printf '%s\n' '== existing script-test naming and invocations =='
rg -n -i -C2 \
  '(python[0-9.]*[[:space:]]+scripts/test_|unittest[[:space:]]|discover[[:space:]]|test_openapi_release_provenance)' \
  .github scripts README.md Makefile pyproject.toml setup.cfg pytest.ini tox.ini 2>/dev/null || true

printf '%s\n' '== exact file identity =='
git ls-tree -l HEAD -- scripts/openapi_release_provenance.py scripts/test_openapi_release_provenance.py

Length of output: 1828

@seonghobae Review completed for exact head 3d141e749641ccf677814b636071755234611620.

I verified that the stated base is an ancestor and that the exact range adds only the two specified files. The new blob IDs match the stated IDs. The implementation uses raw bytes for SHA-256, enforces lowercase 40-hex source revisions, and renders sorted compact JSON.

Finding — symlinked parent directories bypass contract authority controls

_read_bounded_regular_file() checks only the final contract path component. If docs or docs/deployment is a symlink, root / CONTRACT_RELATIVE_PATH can resolve outside repository_root. The target can still be a regular non-symlink file, so Lines 29-33 and Lines 37-49 accept it.

Reject symlinks in every path component under repository_root, or open each directory component through directory file descriptors with O_NOFOLLOW. Add regression coverage for a symlinked docs or docs/deployment directory.

This finding remains unresolved. I found no separate fuzz concern for this standard-library provenance-only path.

🧠 Learnings used

Learnt from: CR
Repo: ContextualWisdomLab/clearfolio PR: 0
File: AGENTS.md:0-0
Timestamp: 2026-08-15T01:35:31.643Z
Learning: Applies to **/* : Fuzzing coverage for security-sensitive parsing/header paths must remain
  discoverable through Jazzer or ClusterFuzzLite-compatible targets.

⚠️ Action not completed

Review rate limited.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

opencode-agent · 2026-08-19T11:14:24Z

Queued @opencode-agent ; Already queued @cwl-noema-review on this exact request for PR #426 at head d336988a9b34e973bfb2fb3cc7ba8dee8bd62e30. Central exact-name Actions artifacts are the durable dispatch ledger; existing review workflows remain authoritative for the final verdict and failure evidence.

opencode-agent · 2026-08-20T03:34:39Z