Repository navigation
docs: verification pack (evidence ladder, tests, readiness) - #114
Conversation
…nical, coverage, demos) Pack per the 2026-10-15 fleet directive. Tests, readiness verdict and status block follow once the suites have run at this commit. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Validate at 90598a1 (vitest 105 x2, site 124, package-runtime x3), the PR evidence gate, an npx gitpin@0.6.4 smoke on this repo's own history, and the site redeploy that removed the stale attribution. Coverage rungs updated. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
|
Important
This repository does not receive automatic reviews because it has fewer than 10 stars. ⚙️ Run configuration
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 8b21aed508
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| ## Auth and secrets | ||
|
|
||
| - Gate and stdio MCP: no auth; they run as the local user against local repos. | ||
| - HTTP MCP: `Authorization: Bearer` compared with `timingSafeEqual` against `GITPIN_MCP_TOKEN` (legacy alias `REPOCONTEXT_MCP_TOKEN`); the server refuses to start without it (`src/http.ts:15`). `GITPIN_ALLOWED_HOSTS` is a Host-header allowlist; `/healthz` skips it. Request size capped at 1 MiB, `content-length` required, no chunked bodies. Default bind is `0.0.0.0` on this commit; PR #102 changes that and is pending, not evaluated here. |
There was a problem hiding this comment.
For readers treating this pack as the verification of 90598a1, this describes the pre-fix HTTP behavior: that SHA already contains src/http.ts:138, which defaults to 127.0.0.1, rejects non-loopback binds without an allowlist, and validates browser origins. COVERAGE.md:3 even acknowledges that the loopback change landed between e4c550e and 90598a1, so saying the default is 0.0.0.0 and the fix is still pending makes the security and deployment assessment stale relative to the tested SHA.
Useful? React with 👍 / 👎.
| verdict: Verified End-to-End Ready | ||
| functional_ready: yes | ||
| demo_ready: partial | ||
| production_ready: yes |
There was a problem hiding this comment.
When this machine-readable block is consumed as the verdict for the scope declared below, production_ready: yes also covers the evidence prove/verify path, but COVERAGE.md:17-20 rates those MCP capabilities only as Tested and TESTS.md:52-55 explicitly says no real MCP client session was executed. The production smoke only exercised gitpin gate, so either narrow the verdict's scope to that gate or run a production prove/verify smoke before marking the broader scope production-ready.
Useful? React with 👍 / 👎.
| @@ -0,0 +1,54 @@ | |||
| # GitPin Verification Pack | |||
There was a problem hiding this comment.
Add this new durable documentation section to docs/README.md: a repo-wide search at this commit finds no reference to docs/verification/ outside the evidence manifest, so users entering through the authoritative documentation map cannot discover the pack. The repository specifically defines docs/ as being indexed by docs/README.md.
AGENTS.md reference: AGENTS.md:L16-L19
Useful? React with 👍 / 👎.
| | `npx -y gitpin@0.6.4 gate --base 56fcab9 --head df94cd3` on this repository (#113 alone, with its manifest) | `evidence-verified`, exit **0** | | ||
| | `npx -y gitpin@0.6.4 gate --base 56fcab9 --head 90598a1` (two PRs; only #111's manifest at head) | `failed`, `uncovered-change` on `.github/workflows/ci.yml` and `scripts/verify-ci-runner-routing.mjs`, exit **1**. These are exactly the two files #111 does not claim. | |
There was a problem hiding this comment.
Replace the abbreviated revisions in these production-smoke commands with the actual 40-character SHAs. resolveCommit rejects anything that does not match 40 hexadecimal characters before invoking Git, so the displayed --base 56fcab9 --head df94cd3 command cannot produce the reported successful gate result; the analogous local command at line 49 using origin/main and HEAD is likewise impossible as written. This makes the primary production evidence unreproducible and conflicts with the repository's commit-pinned, full-SHA contract.
AGENTS.md reference: AGENTS.md:L52-L53
Useful? React with 👍 / 👎.
|
|
||
| | Workflow | Trigger | What it does | | ||
| | --- | --- | --- | | ||
| | `ci.yml` | pull_request, push | `pnpm validate` (node matrix), package job (`verify:package`, `pnpm audit --audit-level high`, `npm pack`), website Playwright job | |
There was a problem hiding this comment.
Document workflow_dispatch in this trigger column. The verified ci.yml contains that trigger specifically so the exact merged SHA can be tested after token-driven auto-merges, and the readiness report later identifies adding it as a verification fix; listing only pull_request, push therefore omits the mechanism used to establish the reported main-SHA test evidence.
Useful? React with 👍 / 👎.
| functional_ready: yes | ||
| demo_ready: partial | ||
| production_ready: yes | ||
| deployed_sha: "npm gitpin 0.6.4 (release v0.6.4); MCP Registry 0.6.4; Pages at 90598a1" |
There was a problem hiding this comment.
Make this machine-readable provenance field contain exact commit identifiers rather than a prose mixture of versions and an abbreviated commit. npm and the MCP Registry resolve to release commit 514799cb0eae55e965e51d510d5e7a0a7604c9cc, while Pages is reported from a different commit, so the current singular value cannot be parsed or compared to any deployed revision and only identifies Pages as 90598a1. Split the channels into separate full-SHA fields or otherwise preserve their exact commit mapping.
AGENTS.md reference: AGENTS.md:L5-L10
Useful? React with 👍 / 👎.
| - **Hook (0:00–0:15).** A PR tries to weaken its own gate by editing `.gitpin/gate.yml` in head. The gate reads policy from base, reports `policy-change-blocked`, and exits 1. | ||
| - **Axes (0:15–0:45).** Base versus head trust. Coverage from the merge-base diff, not from the PR description. A hash-pinned line versus a semantic check. | ||
| - **Behaviour, then diagram (0:45–3:15).** Reuse the GP1 fail and pass takes. Walk the 17-hop trace in [TECHNICAL.md](TECHNICAL.md) on the code stage: `gate.ts` policy block (55–67), line-slice hash (108–115), coverage (169–173). Show the Mermaid diagram after the behaviour. | ||
| - **MCP (3:15–4:15).** A real MCP client over stdio calling `pin.search` → `pin.prove` → `pin.verify`, ending with the evidence pack's full SHA and hash. |
There was a problem hiding this comment.
Use either pin.search_docs or pin.search_code in the planned MCP recording. The server's 12-tool contract has no pin.search method, as the inventory in FUNCTIONAL.md:33 also confirms, so the scripted pin.search → pin.prove → pin.verify session here—and the same sequence at line 40—cannot be executed by a real MCP client.
Useful? React with 👍 / 👎.
|
|
||
| ## Data | ||
|
|
||
| - No database, queue, cache or embeddings. Git is the only data store, read through `git show`, `git diff`, `git rev-parse`, `git merge-base`, `git grep` (`execFileSync`, no shell). |
There was a problem hiding this comment.
Qualify this as having no persistent content cache, or remove the registry memoization. At the verified SHA, src/registry.ts:19 holds a module-level cached registry and loadRegistry returns it without rereading repositories.yaml, so a long-lived stdio or HTTP process does not observe registry edits until the cache is explicitly cleared or the process restarts. The unqualified statement that no cache exists hides this operational behavior and conflicts with the repository's no-cache rule.
AGENTS.md reference: AGENTS.md:L52-L57
Useful? React with 👍 / 👎.
| production_ready: yes | ||
| deployed_sha: "npm gitpin 0.6.4 (release v0.6.4); MCP Registry 0.6.4; Pages at 90598a1" | ||
| tests: "vitest: 105/105 (18 files) x node22/node24 @ 90598a1 run 38736417735; site Playwright: 124/124 @ 90598a1; package + package-runtime node20/22/24: pass @ 90598a1; CodeQL: pass @ 90598a1; PR evidence gate: pass on #111, #113; prod smoke: npx gitpin@0.6.4 gate exit 0 (covered) and exit 1 (uncovered-change) on this repo 2026-10-15" | ||
| films: ["D:\\OneDrive - Maya Modest LLC\\Videos\\Portfolio\\GitPin\\01 - The Gate That Wants Evidence.mp4", "D:\\OneDrive - Maya Modest LLC\\Videos\\Portfolio\\GitPin\\02 - The Gate in 30 Seconds.mp4", "D:\\OneDrive - Maya Modest LLC\\Videos\\Evergreen\\Proof Clips\\02 - GitPin Evidence Gate.mp4"] |
There was a problem hiding this comment.
Replace these absolute OneDrive paths with neutral media-relative identifiers such as the Videos\... values already used in DEMOS.md. This public status block reintroduces Maya Modest LLC three times immediately after commit #98 removed company attribution and docs/launch.md:44 established that unrelated companies should not be mentioned, while also exposing an owner-specific workstation organization path that external reviewers cannot use.
Useful? React with 👍 / 👎.
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
Adds
docs/verification/, the verification pack per the 2026-10-15 fleet directive:gitpin gate.Evidence it records:
90598a1: Validate run 38736417735 passed every job. Vitest 105/105 on Node 22 and 24; site Playwright 124 passed; package and package-runtime passed on Node 20, 22 and 24. CodeQL passed.npx -y gitpin@0.6.4 gateon this repository's own history. ci: let Validate be dispatched on the merged main SHA #113 alone givesevidence-verified, exit 0. Two PRs with one manifest giveuncovered-changeon exactly the 2 unclaimed paths, exit 1.90598a1. The live site still carried the attribution removed in chore: remove company attribution; independent maintainer contact #98..gitpin/change-evidence.jsonhas one claim covering the seven files. A localgitpin gate --base origin/main --head HEADreturnedevidence-verified, exit 0.Docs only; no code change.
🤖 Generated with Claude Code