[authentication/2.8] Retrieve authenticated enrollment completion receipts by omry · Pull Request #70 · omry/arbiter

omry · 2026-10-25T13:28:36Z

Add fixed lifecycle-control retrieval of an already committed enrollment result. The server authenticates the registered access key against a fresh TLS exporter, purpose and exact result digest; denial and inactivity prevent retrieval. The Go client uses remembered server trust and preserves prepared keys after lost replies without a pairing PSK.

Exercise fresh retries, cross-connection replay, wrong keys and contexts, missing/changed records, denial/inactivity and elapsed pairing deadlines. Include the real Python/Go receipt peer cases in all six native CI jobs. Product activation and durable promotion remain in slice2.6.

omry · 2026-10-25T13:37:52Z

PR-cycle state — maintained automatically. Do not edit by hand.

Mechanical PR-cycle state (JSON)

{
  "approval": {
    "candidate_revision_fingerprint": "sha256:2309658e7765fd7eeadc0e8a16b33551ce6101e9b53574cd5ae8aeb96ed1576d",
    "evidence": {
      "attestations": [
        {
          "baseline_identity": "sha256:95080c8129b4da2db4db318d829532ce16d721ef805c4a756c90a714c0262483",
          "closure_identity": "sha256:3af1c603a3de292f05c79af4ad7dafa2475887c3765033ae191ceb349e1011c8",
          "document_identity": "sha256:16c8c6225b91d2cf19a98f33f93d2d691d0d7ab1eeed05831275ce616938be47",
          "sidecar_identity": "sha256:79c904f72e578226e1651232379c453990fac14a2735deda6b872acf2cd1d28c"
        },
        {
          "baseline_identity": "sha256:ad1ec634421f4d4b16b5cb61c07844e945fa11d0737e7e59757b3b3aabbf21ce",
          "closure_identity": "sha256:cd18dad85e70cd7dd9335ab82b462d8a03bbb828fa5cfecf91d1a3fb1317d8f0",
          "document_identity": "sha256:a9d3c2a74376b48f8af8fc97c2e7c18069b97e5e9b209ce3658fcff8bf8083b1",
          "sidecar_identity": "sha256:3c969d1c7722b7db806221b23c15d19e577c5e6ad472ba56f7714af25d9cba19"
        },
        {
          "closure_identity": "sha256:f1c9ffb91b140f505fb3ec8906a2c78e68f5580fcd75d0a9a2d29e0d8dd15e31",
          "document_identity": "sha256:95080c8129b4da2db4db318d829532ce16d721ef805c4a756c90a714c0262483",
          "sidecar_identity": "sha256:b02245b52befcecf939bd2373a16912cad483a5a100c7f5733856cd39b4921b5"
        }
      ],
      "candidate_revision_fingerprint": "sha256:2309658e7765fd7eeadc0e8a16b33551ce6101e9b53574cd5ae8aeb96ed1576d",
      "check_conclusions": [
        {
          "conclusion": "SUCCESS",
          "name": "Gitar",
          "run_id": 121232103516
        },
        {
          "conclusion": "SUCCESS",
          "name": "Platform Linux arm64",
          "run_id": 121232105419
        },
        {
          "conclusion": "SUCCESS",
          "name": "Platform Linux x64",
          "run_id": 121232105516
        },
        {
          "conclusion": "SUCCESS",
          "name": "Platform Windows arm64",
          "run_id": 121232105404
        },
        {
          "conclusion": "SUCCESS",
          "name": "Platform Windows x64",
          "run_id": 121232105731
        },
        {
          "conclusion": "SUCCESS",
          "name": "Platform macOS arm64",
          "run_id": 121232105515
        },
        {
          "conclusion": "SUCCESS",
          "name": "Platform macOS x64",
          "run_id": 121232105654
        },
        {
          "conclusion": "SUCCESS",
          "name": "Python 3.10",
          "run_id": 121232105556
        },
        {
          "conclusion": "SUCCESS",
          "name": "Python 3.11",
          "run_id": 121232105513
        },
        {
          "conclusion": "SUCCESS",
          "name": "Python 3.12",
          "run_id": 121232105558
        },
        {
          "conclusion": "SUCCESS",
          "name": "Python 3.14",
          "run_id": 121232105371
        },
        {
          "conclusion": "SUCCESS",
          "name": "Python lint",
          "run_id": 121232105192
        },
        {
          "conclusion": "SUCCESS",
          "name": "Website",
          "run_id": 121232105429
        }
      ],
      "delivery_deferral_ledger_digest": "sha256:4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945",
      "finding_dispositions_digest": "sha256:9994c89b71667c2d35f78ae8d8db7a7a7f98754fc5c4ec731d87de9fe8d2b502",
      "operation_identity": "sha256:4402be94646e433b30b88474e95653b3b010af28dfd48495573f63e895a8ccb7",
      "review_request": {
        "body_digest": "sha256:4259425172485c10432f930232ee62a3ff863cd9a1e6fdfe4200d1307afd671f",
        "id": 6400635214
      },
      "review_result": {
        "body_digest": "sha256:32a8d31df2c400b789529ccef59604314d6f89af6eef8d52e9b77132cebe5753",
        "id": 6400649425
      }
    },
    "evidence_fingerprint": "sha256:881fc7e2b5865581fd5d3fe5be736aecaca2acacb2d1efd8513de8b85f1a045e",
    "head_sha": "d85932a4ec18fcbe976403e2497dc6d18b2009ed",
    "operation_identity": "sha256:4402be94646e433b30b88474e95653b3b010af28dfd48495573f63e895a8ccb7",
    "review_request_id": 6400635214,
    "review_result_id": 6400649425,
    "status": "approved-evidence-recorded"
  },
  "candidate_revision_fingerprint": "sha256:2309658e7765fd7eeadc0e8a16b33551ce6101e9b53574cd5ae8aeb96ed1576d",
  "check_conclusions": [
    {
      "conclusion": "SUCCESS",
      "name": "Gitar",
      "run_id": 121232103516
    },
    {
      "conclusion": "SUCCESS",
      "name": "Platform Linux arm64",
      "run_id": 121232105419
    },
    {
      "conclusion": "SUCCESS",
      "name": "Platform Linux x64",
      "run_id": 121232105516
    },
    {
      "conclusion": "SUCCESS",
      "name": "Platform Windows arm64",
      "run_id": 121232105404
    },
    {
      "conclusion": "SUCCESS",
      "name": "Platform Windows x64",
      "run_id": 121232105731
    },
    {
      "conclusion": "SUCCESS",
      "name": "Platform macOS arm64",
      "run_id": 121232105515
    },
    {
      "conclusion": "SUCCESS",
      "name": "Platform macOS x64",
      "run_id": 121232105654
    },
    {
      "conclusion": "SUCCESS",
      "name": "Python 3.10",
      "run_id": 121232105556
    },
    {
      "conclusion": "SUCCESS",
      "name": "Python 3.11",
      "run_id": 121232105513
    },
    {
      "conclusion": "SUCCESS",
      "name": "Python 3.12",
      "run_id": 121232105558
    },
    {
      "conclusion": "SUCCESS",
      "name": "Python 3.14",
      "run_id": 121232105371
    },
    {
      "conclusion": "SUCCESS",
      "name": "Python lint",
      "run_id": 121232105192
    },
    {
      "conclusion": "SUCCESS",
      "name": "Website",
      "run_id": 121232105429
    }
  ],
  "check_observations": [
    {
      "checks": [
        {
          "conclusion": "SUCCESS",
          "name": "Gitar",
          "run_id": 121185956449,
          "run_status": "completed",
          "status": "success",
          "url": "https://github.com/omry/arbiter/runs/121185956449"
        },
        {
          "conclusion": "SUCCESS",
          "name": "Platform Linux arm64",
          "run_id": 121182274513,
          "run_status": "completed",
          "status": "success",
          "url": "https://github.com/omry/arbiter/actions/runs/40197777898/job/121182274513"
        },
        {
          "conclusion": "SUCCESS",
          "name": "Platform Linux x64",
          "run_id": 121182274564,
          "run_status": "completed",
          "status": "success",
          "url": "https://github.com/omry/arbiter/actions/runs/40197777898/job/121182274564"
        },
        {
          "conclusion": "FAILURE",
          "name": "Platform Windows arm64",
          "run_id": 121182274492,
          "run_status": "completed",
          "status": "failure",
          "url": "https://github.com/omry/arbiter/actions/runs/40197777898/job/121182274492"
        },
        {
          "conclusion": "FAILURE",
          "name": "Platform Windows x64",
          "run_id": 121182274502,
          "run_status": "completed",
          "status": "failure",
          "url": "https://github.com/omry/arbiter/actions/runs/40197777898/job/121182274502"
        },
        {
          "conclusion": "SUCCESS",
          "name": "Platform macOS arm64",
          "run_id": 121182274516,
          "run_status": "completed",
          "status": "success",
          "url": "https://github.com/omry/arbiter/actions/runs/40197777898/job/121182274516"
        },
        {
          "conclusion": "SUCCESS",
          "name": "Platform macOS x64",
          "run_id": 121182274515,
          "run_status": "completed",
          "status": "success",
          "url": "https://github.com/omry/arbiter/actions/runs/40197777898/job/121182274515"
        },
        {
          "conclusion": "SUCCESS",
          "name": "Python 3.10",
          "run_id": 121182274585,
          "run_status": "completed",
          "status": "success",
          "url": "https://github.com/omry/arbiter/actions/runs/40197777898/job/121182274585"
        },
        {
          "conclusion": "SUCCESS",
          "name": "Python 3.11",
          "run_id": 121182274482,
          "run_status": "completed",
          "status": "success",
          "url": "https://github.com/omry/arbiter/actions/runs/40197777898/job/121182274482"
        },
        {
          "conclusion": "SUCCESS",
          "name": "Python 3.12",
          "run_id": 121182274522,
          "run_status": "completed",
          "status": "success",
          "url": "https://github.com/omry/arbiter/actions/runs/40197777898/job/121182274522"
        },
        {
          "conclusion": "SUCCESS",
          "name": "Python 3.14",
          "run_id": 121182274494,
          "run_status": "completed",
          "status": "success",
          "url": "https://github.com/omry/arbiter/actions/runs/40197777898/job/121182274494"
        },
        {
          "conclusion": "SUCCESS",
          "name": "Python lint",
          "run_id": 121182274323,
          "run_status": "completed",
          "status": "success",
          "url": "https://github.com/omry/arbiter/actions/runs/40197777898/job/121182274323"
        },
        {
          "conclusion": "SUCCESS",
          "name": "Website",
          "run_id": 121182274426,
          "run_status": "completed",
          "status": "success",
          "url": "https://github.com/omry/arbiter/actions/runs/40197777898/job/121182274426"
        }
      ],
      "head_sha": "bbe36bca19cf92de34629b7cc5cea793acd44700",
      "id": "sha256:4692d579731c02f0b4183625845f103ca5ade7ca80e9daabbb952b897fa68ca9",
      "required_checks": [
        "Gitar",
        "Platform Linux arm64",
        "Platform Linux x64",
        "Platform Windows arm64",
        "Platform Windows x64",
        "Platform macOS arm64",
        "Platform macOS x64",
        "Python 3.10",
        "Python 3.11",
        "Python 3.12",
        "Python 3.14",
        "Python lint",
        "Website"
      ],
      "status": "failure"
    },
    {
      "checks": [
        {
          "conclusion": "SUCCESS",
          "name": "Gitar",
          "run_id": 121232103516,
          "run_status": "completed",
          "status": "success",
          "url": "https://github.com/omry/arbiter/runs/121232103516"
        },
        {
          "conclusion": "SUCCESS",
          "name": "Platform Linux arm64",
          "run_id": 121232105419,
          "run_status": "completed",
          "status": "success",
          "url": "https://github.com/omry/arbiter/actions/runs/40214332781/job/121232105419"
        },
        {
          "conclusion": "SUCCESS",
          "name": "Platform Linux x64",
          "run_id": 121232105516,
          "run_status": "completed",
          "status": "success",
          "url": "https://github.com/omry/arbiter/actions/runs/40214332781/job/121232105516"
        },
        {
          "conclusion": "SUCCESS",
          "name": "Platform Windows arm64",
          "run_id": 121232105404,
          "run_status": "completed",
          "status": "success",
          "url": "https://github.com/omry/arbiter/actions/runs/40214332781/job/121232105404"
        },
        {
          "conclusion": "SUCCESS",
          "name": "Platform Windows x64",
          "run_id": 121232105731,
          "run_status": "completed",
          "status": "success",
          "url": "https://github.com/omry/arbiter/actions/runs/40214332781/job/121232105731"
        },
        {
          "conclusion": "SUCCESS",
          "name": "Platform macOS arm64",
          "run_id": 121232105515,
          "run_status": "completed",
          "status": "success",
          "url": "https://github.com/omry/arbiter/actions/runs/40214332781/job/121232105515"
        },
        {
          "conclusion": "SUCCESS",
          "name": "Platform macOS x64",
          "run_id": 121232105654,
          "run_status": "completed",
          "status": "success",
          "url": "https://github.com/omry/arbiter/actions/runs/40214332781/job/121232105654"
        },
        {
          "conclusion": "SUCCESS",
          "name": "Python 3.10",
          "run_id": 121232105556,
          "run_status": "completed",
          "status": "success",
          "url": "https://github.com/omry/arbiter/actions/runs/40214332781/job/121232105556"
        },
        {
          "conclusion": "SUCCESS",
          "name": "Python 3.11",
          "run_id": 121232105513,
          "run_status": "completed",
          "status": "success",
          "url": "https://github.com/omry/arbiter/actions/runs/40214332781/job/121232105513"
        },
        {
          "conclusion": "SUCCESS",
          "name": "Python 3.12",
          "run_id": 121232105558,
          "run_status": "completed",
          "status": "success",
          "url": "https://github.com/omry/arbiter/actions/runs/40214332781/job/121232105558"
        },
        {
          "conclusion": "SUCCESS",
          "name": "Python 3.14",
          "run_id": 121232105371,
          "run_status": "completed",
          "status": "success",
          "url": "https://github.com/omry/arbiter/actions/runs/40214332781/job/121232105371"
        },
        {
          "conclusion": "SUCCESS",
          "name": "Python lint",
          "run_id": 121232105192,
          "run_status": "completed",
          "status": "success",
          "url": "https://github.com/omry/arbiter/actions/runs/40214332781/job/121232105192"
        },
        {
          "conclusion": "SUCCESS",
          "name": "Website",
          "run_id": 121232105429,
          "run_status": "completed",
          "status": "success",
          "url": "https://github.com/omry/arbiter/actions/runs/40214332781/job/121232105429"
        }
      ],
      "head_sha": "d85932a4ec18fcbe976403e2497dc6d18b2009ed",
      "id": "sha256:83b1cd32b41fe132efc82c7a83b6d186f7307c5f1701cf81c21dc529a93a7d1b",
      "required_checks": [
        "Gitar",
        "Platform Linux arm64",
        "Platform Linux x64",
        "Platform Windows arm64",
        "Platform Windows x64",
        "Platform macOS arm64",
        "Platform macOS x64",
        "Python 3.10",
        "Python 3.11",
        "Python 3.12",
        "Python 3.14",
        "Python lint",
        "Website"
      ],
      "status": "success"
    },
    {
      "checks": [
        {
          "conclusion": "SUCCESS",
          "name": "Gitar",
          "run_id": 121193975528,
          "run_status": "completed",
          "status": "success",
          "url": "https://github.com/omry/arbiter/runs/121193975528"
        },
        {
          "conclusion": "SUCCESS",
          "name": "Platform Linux arm64",
          "run_id": 121193987339,
          "run_status": "completed",
          "status": "success",
          "url": "https://github.com/omry/arbiter/actions/runs/40201679381/job/121193987339"
        },
        {
          "conclusion": "SUCCESS",
          "name": "Platform Linux x64",
          "run_id": 121193987005,
          "run_status": "completed",
          "status": "success",
          "url": "https://github.com/omry/arbiter/actions/runs/40201679381/job/121193987005"
        },
        {
          "conclusion": "SUCCESS",
          "name": "Platform Windows arm64",
          "run_id": 121193987033,
          "run_status": "completed",
          "status": "success",
          "url": "https://github.com/omry/arbiter/actions/runs/40201679381/job/121193987033"
        },
        {
          "conclusion": "SUCCESS",
          "name": "Platform Windows x64",
          "run_id": 121193987048,
          "run_status": "completed",
          "status": "success",
          "url": "https://github.com/omry/arbiter/actions/runs/40201679381/job/121193987048"
        },
        {
          "conclusion": "SUCCESS",
          "name": "Platform macOS arm64",
          "run_id": 121193987174,
          "run_status": "completed",
          "status": "success",
          "url": "https://github.com/omry/arbiter/actions/runs/40201679381/job/121193987174"
        },
        {
          "conclusion": "SUCCESS",
          "name": "Platform macOS x64",
          "run_id": 121193987074,
          "run_status": "completed",
          "status": "success",
          "url": "https://github.com/omry/arbiter/actions/runs/40201679381/job/121193987074"
        },
        {
          "conclusion": "SUCCESS",
          "name": "Python 3.10",
          "run_id": 121193987148,
          "run_status": "completed",
          "status": "success",
          "url": "https://github.com/omry/arbiter/actions/runs/40201679381/job/121193987148"
        },
        {
          "conclusion": "SUCCESS",
          "name": "Python 3.11",
          "run_id": 121193987026,
          "run_status": "completed",
          "status": "success",
          "url": "https://github.com/omry/arbiter/actions/runs/40201679381/job/121193987026"
        },
        {
          "conclusion": "SUCCESS",
          "name": "Python 3.12",
          "run_id": 121193987109,
          "run_status": "completed",
          "status": "success",
          "url": "https://github.com/omry/arbiter/actions/runs/40201679381/job/121193987109"
        },
        {
          "conclusion": "SUCCESS",
          "name": "Python 3.14",
          "run_id": 121193987011,
          "run_status": "completed",
          "status": "success",
          "url": "https://github.com/omry/arbiter/actions/runs/40201679381/job/121193987011"
        },
        {
          "conclusion": "SUCCESS",
          "name": "Python lint",
          "run_id": 121193986946,
          "run_status": "completed",
          "status": "success",
          "url": "https://github.com/omry/arbiter/actions/runs/40201679381/job/121193986946"
        },
        {
          "conclusion": "SUCCESS",
          "name": "Website",
          "run_id": 121193986731,
          "run_status": "completed",
          "status": "success",
          "url": "https://github.com/omry/arbiter/actions/runs/40201679381/job/121193986731"
        }
      ],
      "head_sha": "caaf20194f941f7c4f957d11827d88e32d9fcf15",
      "id": "sha256:8457b6a3e3a81f15294ebb769b9d4f0abbd676dd934875171daeff0644ada759",
      "required_checks": [
        "Gitar",
        "Platform Linux arm64",
        "Platform Linux x64",
        "Platform Windows arm64",
        "Platform Windows x64",
        "Platform macOS arm64",
        "Platform macOS x64",
        "Python 3.10",
        "Python 3.11",
        "Python 3.12",
        "Python 3.14",
        "Python lint",
        "Website"
      ],
      "status": "success"
    }
  ],
  "delivery_deferral_ledger_digest": "sha256:4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945",
  "delivery_deferrals": [],
  "findings": [
    {
      "disposition": "Fixed by explicit short empty/oversized pytest IDs; actual corrected-head Windows x64 and ARM64 suites passed with payloads/assertions unchanged.",
      "evidence": [
        "https://github.com/omry/arbiter/actions/runs/40197777898/job/121182274502",
        "/home/omry/dev/arbiter/temp/authentication-milestone-2/2.8/pr70-cycle/windows-x64-failure.log",
        "/home/omry/dev/arbiter/temp/authentication-milestone-2/2.8/pr70-cycle/round1-checks-result.json",
        "/home/omry/dev/arbiter/temp/authentication-milestone-2/2.8/pr70-cycle/correction1/correction-verify1.json",
        "/home/omry/dev/arbiter/temp/authentication-milestone-2/2.8/pr70-cycle/round2-native/native-execution-proof.json",
        "https://github.com/omry/arbiter/actions/runs/40201679381/job/121193987033",
        "https://github.com/omry/arbiter/actions/runs/40201679381/job/121193987048"
      ],
      "head_sha": "bbe36bca19cf92de34629b7cc5cea793acd44700",
      "id": "CI-70-WINDOWS-PYTEST-ID-001",
      "invariant": "All six native platform suites must execute oversized receipt-input rejection tests.",
      "locations": [
        "server/tests/unit/test_enrollment_receipt.py:test_invalid_result_bounds"
      ],
      "proposed_paths": [
        "server/tests/unit/test_enrollment_receipt.py"
      ],
      "rationale": "Pytest expands the65520-byte parameter into PYTEST_CURRENT_TEST; Windows rejects environment values longer than32767characters, causing setup and teardown errors. Give empty/oversized cases short explicitIDs.",
      "response_urls": [],
      "severity": "medium",
      "source": "required-check-failure",
      "status": "resolved",
      "thread_ids": []
    }
  ],
  "pr": {
    "base_ref": "pr69",
    "base_sha": "565e86fad4b3c7cde9f10e3b33648d12128da47b",
    "body_digest": "sha256:ec7134d80f8596a52cb6ea3995c130279c7063a70ba7a3c5f8c7664063249b7f",
    "body_identity_version": 2,
    "diff_digest": "sha256:4ba16d1bc68e12ad22997a84a1524ec435431b2b8af60de40daa922be155929f",
    "head_ref": "pr70",
    "head_sha": "d85932a4ec18fcbe976403e2497dc6d18b2009ed",
    "pr": 70,
    "repository": "omry/arbiter",
    "scope_authority": [
      {
        "digest": "sha256:b6511414b3a9b485542df83c8f7abfc499dc8d06e522819b48e162a562d21c57",
        "path": "docs/authentication/high-level-design.md"
      },
      {
        "digest": "sha256:c576091af919c3ec99f0e0edb5795cf4e7bd37a44415ae24742393822317ad3d",
        "path": "docs/authentication/implementation-plan.md"
      },
      {
        "digest": "sha256:d56e92a7cb01f131ba499650c4a5d7b2c8d17adf2cdc7d612eee7c5f53d07929",
        "path": "docs/authentication/requirements.md"
      }
    ],
    "title_digest": "sha256:0a6386ef4bd08d734f3651cdb19ab82a846a029a25163f2ed5170ebc94107481"
  },
  "record_version": 13,
  "review_observations": [
    {
      "base_ref": "pr69",
      "base_sha": "565e86fad4b3c7cde9f10e3b33648d12128da47b",
      "evidence_digest": "sha256:6905a15bde12df7c2ed68fb390f76db5a937912a535c4176e9f3b7809a77e754",
      "head_sha": "caaf20194f941f7c4f957d11827d88e32d9fcf15",
      "id": "sha256:5d1ef3fecb61db48e7156d0c9457466de61f60a006afb1c5fc0961f2a8b2c28d",
      "poll": {
        "completed_at": "2026-10-25T14:56:16.303Z",
        "elapsed_seconds": 1805.433,
        "observations": 132,
        "started_at": "2026-10-25T14:24:22.913Z"
      },
      "request_comment_id": 6398851399,
      "status": "timeout"
    }
  ],
  "review_requests": [
    {
      "base_established_at": "2026-10-25T13:28:39Z",
      "base_ref": "pr69",
      "base_sha": "565e86fad4b3c7cde9f10e3b33648d12128da47b",
      "body_digest": "sha256:fc164d1265f56819f0717caa19a00be54b50347f4cff890abdc456bf875e5112",
      "created_at": "2026-10-25T13:48:44Z",
      "head_sha": "bbe36bca19cf92de34629b7cc5cea793acd44700",
      "id": 6398453459,
      "kind": "regular-review"
    },
    {
      "base_established_at": "2026-10-25T13:28:39Z",
      "base_ref": "pr69",
      "base_sha": "565e86fad4b3c7cde9f10e3b33648d12128da47b",
      "body_digest": "sha256:01d5183cfa8cbe3bac63311cd9b7ee43ae956f17a2ed62c0b69e4df9014d4e6a",
      "created_at": "2026-10-25T14:25:53Z",
      "head_sha": "caaf20194f941f7c4f957d11827d88e32d9fcf15",
      "id": 6398851399,
      "kind": "regular-review"
    },
    {
      "base_established_at": "2026-10-25T13:28:39Z",
      "base_ref": "pr69",
      "base_sha": "565e86fad4b3c7cde9f10e3b33648d12128da47b",
      "body_digest": "sha256:4259425172485c10432f930232ee62a3ff863cd9a1e6fdfe4200d1307afd671f",
      "created_at": "2026-10-25T17:11:41Z",
      "head_sha": "d85932a4ec18fcbe976403e2497dc6d18b2009ed",
      "id": 6400635214,
      "kind": "regular-review"
    }
  ],
  "review_results": [
    {
      "base_ref": "pr69",
      "base_sha": "565e86fad4b3c7cde9f10e3b33648d12128da47b",
      "body_digest": "sha256:34d6c3e7438f8a2105230ff0913f2833a007c24966855881a45a4d6489b1e79f",
      "commit_id": "bbe36bca19cf92de34629b7cc5cea793acd44700",
      "id": 6398470330,
      "inline_message_ids": [],
      "request_comment_id": 6398453459,
      "result_kind": "clean",
      "status": "result",
      "submitted_at": "2026-10-25T13:50:21Z",
      "unresolved_thread_ids": []
    },
    {
      "base_ref": "pr69",
      "base_sha": "565e86fad4b3c7cde9f10e3b33648d12128da47b",
      "body_digest": "sha256:92814850f47dbb79adbf708b116a468fc77bcee37298d14f1c996dc66125dc2c",
      "commit_id": "caaf20194f941f7c4f957d11827d88e32d9fcf15",
      "id": 6399251211,
      "inline_message_ids": [],
      "request_comment_id": 6398851399,
      "result_kind": "clean",
      "status": "result",
      "submitted_at": "2026-10-25T15:03:33Z",
      "unresolved_thread_ids": []
    },
    {
      "base_ref": "pr69",
      "base_sha": "565e86fad4b3c7cde9f10e3b33648d12128da47b",
      "body_digest": "sha256:32a8d31df2c400b789529ccef59604314d6f89af6eef8d52e9b77132cebe5753",
      "commit_id": "d85932a4ec18fcbe976403e2497dc6d18b2009ed",
      "id": 6400649425,
      "inline_message_ids": [],
      "request_comment_id": 6400635214,
      "result_kind": "clean",
      "status": "result",
      "submitted_at": "2026-10-25T17:12:59Z",
      "unresolved_thread_ids": []
    }
  ],
  "revision_fingerprint": "sha256:2309658e7765fd7eeadc0e8a16b33551ce6101e9b53574cd5ae8aeb96ed1576d",
  "rounds": [
    {
      "applied_fix_paths": [
        "server/tests/unit/test_enrollment_receipt.py"
      ],
      "disposition_changes": [
        "CI-70-WINDOWS-PYTEST-ID-001"
      ],
      "effective_diff_digest": "sha256:b1879b66d94d8236e921cb304af7c5d697351ffd4ff40899afb36375f797bc08",
      "finding_ids": [
        "CI-70-WINDOWS-PYTEST-ID-001"
      ],
      "invariants": [
        "All six native platform suites must execute oversized receipt-input rejection tests."
      ],
      "outcome": "corrected",
      "proposed_fix_paths": [
        "server/tests/unit/test_enrollment_receipt.py"
      ],
      "resulting_head": "caaf20194f941f7c4f957d11827d88e32d9fcf15",
      "review_observation_id": null,
      "review_request_id": 6398453459,
      "review_result_id": 6398470330,
      "reviewed_head": "bbe36bca19cf92de34629b7cc5cea793acd44700",
      "root_cause": "Automatic pytest ID embeds65520-byte payload in PYTEST_CURRENT_TEST; Windows rejects value>32767. Explicit shortIDs preserve data/assertions.",
      "round": 1,
      "unresolved_current_slice_findings": 1,
      "unresolved_design_blockers": 0
    },
    {
      "applied_fix_paths": [],
      "disposition_changes": [],
      "effective_diff_digest": "sha256:b1879b66d94d8236e921cb304af7c5d697351ffd4ff40899afb36375f797bc08",
      "finding_ids": [],
      "invariants": [],
      "outcome": "timeout",
      "proposed_fix_paths": [],
      "resulting_head": "caaf20194f941f7c4f957d11827d88e32d9fcf15",
      "review_observation_id": "sha256:5d1ef3fecb61db48e7156d0c9457466de61f60a006afb1c5fc0961f2a8b2c28d",
      "review_request_id": 6398851399,
      "review_result_id": null,
      "reviewed_head": "caaf20194f941f7c4f957d11827d88e32d9fcf15",
      "root_cause": "Trusted Codex bot acknowledged the exact-head request but returned no attributable result within the1800-second poll.",
      "round": 2,
      "unresolved_current_slice_findings": 1,
      "unresolved_design_blockers": 0
    },
    {
      "applied_fix_paths": [],
      "disposition_changes": [
        "CI-70-WINDOWS-PYTEST-ID-001"
      ],
      "effective_diff_digest": "sha256:b1879b66d94d8236e921cb304af7c5d697351ffd4ff40899afb36375f797bc08",
      "finding_ids": [
        "CI-70-WINDOWS-PYTEST-ID-001"
      ],
      "invariants": [
        "All six native platform suites execute oversized receipt-input rejection tests."
      ],
      "outcome": "clean",
      "proposed_fix_paths": [],
      "resulting_head": "caaf20194f941f7c4f957d11827d88e32d9fcf15",
      "review_observation_id": null,
      "review_request_id": 6398851399,
      "review_result_id": 6399251211,
      "reviewed_head": "caaf20194f941f7c4f957d11827d88e32d9fcf15",
      "root_cause": "Prior Windows fixture defect fixed; exact corrected-head clean review, all13CI checks and six actual native execution logs verify closure.",
      "round": 3,
      "unresolved_current_slice_findings": 0,
      "unresolved_design_blockers": 0
    },
    {
      "applied_fix_paths": [],
      "disposition_changes": [],
      "effective_diff_digest": "sha256:4ba16d1bc68e12ad22997a84a1524ec435431b2b8af60de40daa922be155929f",
      "finding_ids": [],
      "invariants": [
        "Authenticated exact-result receipt retrieval preserves current expected-server/access checks, denial/inactivity and immutable custody.",
        "All six native platforms execute43peer cases including9receipt cases at an entire tree equal to reviewed head."
      ],
      "outcome": "clean",
      "proposed_fix_paths": [],
      "resulting_head": "d85932a4ec18fcbe976403e2497dc6d18b2009ed",
      "review_observation_id": null,
      "review_request_id": 6400635214,
      "review_result_id": 6400649425,
      "reviewed_head": "d85932a4ec18fcbe976403e2497dc6d18b2009ed",
      "root_cause": "No new current-slice defect. Fresh exact-head remote review clean; all13CI checks, current complete7localchecks and actual6native execution logs pass. Accepted prepublication local repairs remain separately recorded with exact independent and DBB provenance.",
      "round": 4,
      "unresolved_current_slice_findings": 0,
      "unresolved_design_blockers": 0
    }
  ],
  "schema": "awd:swe:pr-cycle-state",
  "version": 2
}

chatgpt-codex-connector · 2026-10-25T13:41:29Z

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-25T17:13:00.225994Z	`d85932a`	Manual request
🔒 Security Review	🔄 Running since 2026-10-25T13:41:26.986684Z	`bbe36bc`	Draft marked ready

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

omry · 2026-10-25T13:48:44Z

@codex review

Exact head: bbe36bc

chatgpt-codex-connector · 2026-10-25T13:50:21Z

Codex Review: Didn't find any major issues. What shall we delve into next?

Reviewed commit: bbe36bca19

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

omry · 2026-10-25T14:25:53Z

@codex review

Exact head: caaf201

omry · 2026-10-25T15:01:31Z

@codex review

Exact head: caaf201

chatgpt-codex-connector · 2026-10-25T15:03:33Z

Codex Review: Didn't find any major issues. You're on a roll.

Reviewed commit: caaf20194f

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

…eipts Add fixed lifecycle-control retrieval of an already committed enrollment result. The server authenticates the registered access key against a fresh TLS exporter, purpose and exact result digest; denial and inactivity prevent retrieval. The Go client uses remembered server trust and preserves prepared keys after lost replies without a pairing PSK. Exercise fresh retries, cross-connection replay, wrong keys and contexts, missing/changed records, denial/inactivity and elapsed pairing deadlines. Include the real Python/Go receipt peer cases in all six native CI jobs. Product activation and durable promotion remain in slice2.6.

gitar-bot · 2026-10-25T17:01:00Z

Code Review ✅ Approved

🔴 High risk · Adding access-key-gated enrollment receipt retrieval changes authorization; a validation flaw could expose committed results despite denial or inactivity.

Adds fixed lifecycle-control retrieval of an already committed enrollment result, with the server authenticating the registered access key against a fresh TLS exporter, purpose, and exact result digest. No issues found.

Verification

Rules No rules evaluated

Functional validation Not enabled

Set up

_{For more verification details, comment gitar display:verbose.}

Options

Auto-apply is off → Gitar will not commit updates to this branch.
Display: compact → Showing compact verification results.

Comment with these commands to change the behavior for this request:

`Auto-apply`	`Compact`
`gitar auto-apply:on`	`gitar display:verbose`

_{Was this helpful? React with 👍 / 👎 | Powered by Gitar — free for open source}

omry · 2026-10-25T17:11:41Z

@codex review

Exact head: d85932a

chatgpt-codex-connector · 2026-10-25T17:12:59Z

Codex Review: Didn't find any major issues. What shall we delve into next?

Reviewed commit: d85932a4ec

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

omry changed the base branch from main to pr69 October 25, 2026 13:28

omry added this pull request to stack #54 October 25, 2026 13:29

omry marked this pull request as ready for review October 25, 2026 13:41

omry force-pushed the pr70 branch from bbe36bc to caaf201 Compare October 25, 2026 14:19

omry added the approved PR passed review and required checks label Oct 25, 2026

omry force-pushed the pr70 branch from caaf201 to d85932a Compare October 25, 2026 17:00

omry removed the approved PR passed review and required checks label Oct 25, 2026

omry added the approved PR passed review and required checks label Oct 25, 2026

This was referenced Oct 25, 2026

[authentication/2.6.1] Commit enrollment decisions transactionally #71

Merged

[authentication/2.6.2] Activate enrollment and durably promote client credentials #73

Merged

[authentication/2.9] Pairing installation and overload closure #74

Merged

omry merged commit 79d2df4 into main Oct 27, 2026
14 checks passed

omry deleted the pr70 branch October 27, 2026 20:38

Navigation Menu

Repository navigation

[authentication/2.8] Retrieve authenticated enrollment completion receipts - #70

[authentication/2.8] Retrieve authenticated enrollment completion receipts#70
omry merged 1 commit into
pr69from
pr70

omry commented Oct 25, 2026 •

edited

Loading

Uh oh!

omry commented Oct 25, 2026 •

edited

Loading

Uh oh!

chatgpt-codex-connector Bot commented Oct 25, 2026 •

edited

Loading

Uh oh!

omry commented Oct 25, 2026

Uh oh!

chatgpt-codex-connector Bot commented Oct 25, 2026

Uh oh!

omry commented Oct 25, 2026

Uh oh!

omry commented Oct 25, 2026

Uh oh!

chatgpt-codex-connector Bot commented Oct 25, 2026

Uh oh!

gitar-bot Bot commented Oct 25, 2026

Uh oh!

omry commented Oct 25, 2026

Uh oh!

chatgpt-codex-connector Bot commented Oct 25, 2026

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

omry commented Oct 25, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

omry commented Oct 25, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

chatgpt-codex-connector Bot commented Oct 25, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codex Review Summary

Uh oh!

omry commented Oct 25, 2026

Uh oh!

chatgpt-codex-connector Bot commented Oct 25, 2026

Uh oh!

omry commented Oct 25, 2026

Uh oh!

omry commented Oct 25, 2026

Uh oh!

chatgpt-codex-connector Bot commented Oct 25, 2026

Uh oh!

gitar-bot Bot commented Oct 25, 2026

Uh oh!

omry commented Oct 25, 2026

Uh oh!

chatgpt-codex-connector Bot commented Oct 25, 2026

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

omry commented Oct 25, 2026 •

edited

Loading

omry commented Oct 25, 2026 •

edited

Loading

chatgpt-codex-connector Bot commented Oct 25, 2026 •

edited

Loading