runtime: ship provider runtime 5.0.2 in agent-collab 7.0.1 - #188
Conversation
|
You have reached your Codex usage limits for security reviews. Please try again later. |
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
|
Important
This repository does not receive automatic reviews because it has fewer than 10 stars. ⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Plus Run ID: Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: cb04cdbce2
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| the fix takes effect once the primary checkout (whose working tree hosts | ||
| the active hooksPath copies) is updated to a commit containing it. | ||
|
|
||
| - Ship the paired signed provider runtime 5.0.2 generation with source-seal |
There was a problem hiding this comment.
This commit adds the 7.0.1 fragment to CHANGELOG.md even though repository policy requires user-visible changes to commit only their unique changelog.d/ fragment and leaves compilation of this generated file to the release flow. Remove the CHANGELOG.md diff and retain changelog.d/2026-08-30-001-runtime-5.0.2.md.
AGENTS.md reference: AGENTS.md:L41-L42
Useful? React with 👍 / 👎.
| fixes together under wire digest | ||
| `86137024f7e16c67bbeb9f29eaee03d8031e645ce1b5b2c46154aeae7528bcd9`. | ||
|
|
||
| ## What's new - v7.0.1 |
There was a problem hiding this comment.
The newly added unreleased section already describes v7.0.1/runtime 5.0.2, while the section under this renamed heading is unchanged v7.0.0 material and explicitly describes the published runtime 5.0.0 and wire schema 8. Readers now see two v7.0.1 sections with contradictory runtime identities; restore this heading to v7.0.0 and update the consistency check to recognize the separate unreleased-source heading instead.
Useful? React with 👍 / 👎.
1 participant
Summary
Ship agent-collab 7.0.1 with the paired signed and notarized provider runtime 5.0.2 for macOS arm64 and x86_64. The release advances the public client and wire descriptor to schema 9, restores durable Grok managed-route parity, preserves source-seal failure fidelity, and makes admitted repository actions use descriptor-owned inactivity liveness.
Result admission remains semantic and tolerant: provider prose, formatting, passive metadata, previously unseen fingerprints, and unknown ACP metadata do not veto a contract-valid artifact grounded in sealed source evidence. Provider-started failures remain terminal and are never automatically replayed.
Boundary declaration
Generated and release surfaces
SKILL.mdfiles are in parity.CHANGELOG.mdis deterministically compiled from all pending fragments.Verification
Exact signed head:
cb04cdbce23a92f2b93520ac36d9f75049c70c5a.python3 scripts/build_skills.py --checkpython3 scripts/build_marketplace.py --checkpython3 scripts/build-changelog.py --checkpython3 -m unittest discover -s tests -p 'test_*.py' -v— 308 passedpython3 -m unittest discover -s scripts -p 'test_*.py' -v— 456 passedpython3 scripts/check_release_consistency.pypython3 scripts/validate_runtime_manifest_schema.pypython3 scripts/verify_project_estimation_maintenance.py --expected-version 7.0.1python3 scripts/secret_scan.py— 496 source text files, cleanpython3 scripts/check-public-export-safety.py --active-tree --historygit diff --check origin/main...HEADNo semantic provider call was used for these deterministic release gates.
Review and post-condition
Tier 3 because this changes signed runtime verification, routing/liveness behavior, and the release supply chain. The single exact-head Gemini governance attempt ended
source_containment_failed/absolute_outside_rootsafter one provider process and produced no artifact or receipt; cleanup was confirmed and the attempt was not replayed or failed over. A valid independent review remains pending. After normal merge, create the signed annotatedv7.0.1tag through the governed release path, verify all published assets, install and activate once, restart once, read back immutable installed bytes/runtime identity, and then complete the separately governed documentation closeout.author: Codex
standing_directives: Public source boundary, exact-head Tier-3 governance, signed commits, provider-free release validation, no semantic replay, normal merge, and immutable post-release readback followed
tier: 3
cross_check: AWAITING OPERATOR-AUTHORIZED ALTERNATIVE — exact-head Gemini governance at cb04cdb ended source_containment_failed after provider start; no receipt; not replayed
post_condition: Signed v7.0.1 tag and assets verified; install/activate and one restart; immutable installed-byte/runtime readback; final documentation closeout
mcp_coverage_gap: NONE
contributor_rights: OWNER-AUTHORED
operator_reserved: no