Production-ready release candidate: exact-head integration R1 - #407
Production-ready release candidate: exact-head integration R1#407thebtf wants to merge 11 commits into
Conversation
|
Exact combined candidate is 8230a39. Please perform a blind full-delta review across governance, macOS cwd identity, fresh-runner release prerequisites, and the single-writer registry scanner. Do not infer correctness from green tests. Probe wrong types, raw-vs-normalized values, PowerShell/shell continuations, docker --context/image/compose/docker.exe variants, packages spacing/quoting, PAT_TOKEN/GHCR_TOKEN/CR_PAT aliases, canonical sentinel cardinality, and cross-batch interactions. Exact-head image/critical/dev-stand evidence is being produced independently. @coderabbitai review @codex review @gemini-code-assist review |
|
I'll specifically probe:
Note: Codex and Gemini reviews are handled by their respective bots outside my scope — I can only trigger my own review here. ✅ Action performedFull review finished. |
|
Important Review skippedAuto reviews are disabled on base/target branches other than the default branch. Please check the settings in the CodeRabbit UI or the ⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Run ID: You can disable this status message by setting the Use the checkbox below for a quick retry:
WalkthroughВ PR добавлены R12-контракты и trusted authority-валидаторы, обновлены GitHub Actions для release-gates и self-тестов, добавлены evidence-отчёты, а также исправлены проверки Unix-режимов, CWD на macOS и registry-writer sentinel. ChangesR12 authority и release-gates
Estimated code review effort: 5 (Critical) | ~120 minutes Suggested labels: Poem
🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This pull request introduces the R12/B17 trusted authority maintenance framework, which includes comprehensive validation scripts, test suites, and security reviews. Key changes include fixing a macOS path comparison issue in production_readiness_coverage_test.go using os.SameFile, correcting invalid .NET directory Unix file mode API calls across several scripts, and adding robust PowerShell-based PR authority guards and maintenance validators. Additionally, the critical test suite was refactored to enforce single-writer registry constraints more strictly. Feedback on the changes suggests improving the robustness of the exact_prefixes validation in assert-active-candidate-path-authority.ps1 to prevent malformed /**** suffixes when the input already contains the canonical suffix.
Important
The consumer version of Gemini Code Assist on GitHub is being sunset. Starting June 18, 2026, new organization installations will be blocked, and all code review activity will officially cease on July 17, 2026.
For more details on the timeline and next steps, please review the Help Documentation.
| $pathToken = if ($PathKind -eq 'directory-prefix') { $member + '**' } else { $member } | ||
| $normalized = Normalize-AuthorityPath $pathToken | ||
| $isCanonical = if ($PathKind -eq 'exact') { | ||
| $normalized.kind -eq 'exact' -and $normalized.display -ceq $member | ||
| } else { | ||
| $normalized.kind -eq 'prefix' -and ($normalized.path + '/') -ceq $member | ||
| } |
There was a problem hiding this comment.
The exact_prefixes field in exact_r12_overrides is validated using directory-prefix path kind, which appends ** to the path token. However, if the input already contains the canonical /** suffix (consistent with the top-level exact_prefixes field), this results in an invalid /**** suffix and a validation failure. Updating the logic to check if the member already ends with ** and allowing matching against $normalized.display ensures consistency and robustness across all prefix fields.
$pathToken = if ($PathKind -eq 'directory-prefix' -and -not $member.EndsWith('**')) { $member + '**' } else { $member }
$normalized = Normalize-AuthorityPath $pathToken
$isCanonical = if ($PathKind -eq 'exact') {
$normalized.kind -eq 'exact' -and $normalized.display -ceq $member
} else {
$normalized.kind -eq 'prefix' -and ($normalized.display -ceq $member -or ($normalized.path + '/') -ceq $member)
}
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 8230a3941f
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| $allCovered = $true | ||
| foreach ($entry in $DiffEntries) { | ||
| if (@($prefixBases | Where-Object { ([string]$entry.path).StartsWith($_, [System.StringComparison]::Ordinal) }).Count -eq 0) { $allCovered = $false; break } | ||
| } | ||
| if ($allCovered) { return [pscustomobject][ordered]@{ kind='pending-prefix-envelope'; slice=[string]$pending.slice; status_class=[string]$pending.status_class } } |
There was a problem hiding this comment.
When a pending namespace declares both fixed files and a prefix, the current guard can only approve an exact-path-only diff or a prefix-only diff. The updated contract now uses this mixed shape for IMAGE-REMEDIATION-R2, so a valid PR that changes the declared product files plus evidence under the declared prefix fails exact equality first and then fails here because the product files are not prefix-covered. The authorization check should treat exact_paths and exact_prefixes as a union for the same pending envelope.
Useful? React with 👍 / 👎.
| } | ||
|
|
||
| func repositorySingleWriterViolations(repo, allowedWorkflow, allowedScript string) ([]string, error) { | ||
| writePattern := regexp.MustCompile(`(?i)packages\s*:\s*["']?write\b["']?|docker/login-action|\b(?:PERSONAL_ACCESS_TOKEN|PAT_TOKEN|GHCR_TOKEN|CR_PAT)\b|\bdocker(?:\.exe)?\b[^\r\n]*(?:\bpush\b|--push\b)`) |
There was a problem hiding this comment.
A second workflow can spell the package permission with a quoted YAML key such as "packages": write or 'packages': write; that is still a package-write grant, but this scanner only matches an unquoted packages token immediately before the colon. In that scenario the single-writer check returns no violation for another package-writing workflow, bypassing the intended sole registry writer guard.
Useful? React with 👍 / 👎.
| [string[]]$exactPaths = @(Get-OptionalStringArray $pending 'exact_paths') | ||
| [string[]]$exactPrefixes = @(Get-OptionalStringArray $pending 'exact_prefixes') |
There was a problem hiding this comment.
For non-macro R12 pending namespaces, these fields are read through Get-OptionalStringArray, which wraps a scalar string as a one-element array. If the contract accidentally commits exact_prefixes or exact_paths as a JSON string instead of an array, the audit still passes and the PR guard consumes it as valid authority, so wrong-type governance data is not fail-closed. Use the strict array validation path for ordinary pending declarations as well.
Useful? React with 👍 / 👎.
There was a problem hiding this comment.
Code Review
This pull request introduces the R12/B17 trusted authority maintenance framework and addresses several cross-platform and API compatibility issues. Key changes include fixing a macOS-specific test failure in Loom handler tests by using os.SameFile to resolve /var and /private/var path discrepancies, and correcting a critical .NET API compatibility bug in PowerShell scripts by replacing non-existent [System.IO.Directory]::SetUnixFileMode calls with [System.IO.File]::SetUnixFileMode. Additionally, it implements the R12 authority maintenance guard and transition validation scripts (assert-pr-authority-guard.ps1 and assert-pr-authority-maintenance.ps1), enhances path authority and plan ownership audits to support R12 contract schemas and case-sensitive SHA checks, and refactors single-writer registry checks in the critical runtime tests. No review comments were provided, so there is no feedback to evaluate.
Important
The consumer version of Gemini Code Assist on GitHub is being sunset. Starting June 18, 2026, new organization installations will be blocked, and all code review activity will officially cease on July 17, 2026.
For more details on the timeline and next steps, please review the Help Documentation.
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🧹 Nitpick comments (2)
tests/critical/runtime/image_runtime_contract_test.go (1)
722-723: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick winОпционально: задокументировать семантику составного regex.
writePattern/continuationPattern— единственная линия защиты fail-closed проверки single-writer. Небольшой inline-комментарий, поясняющий каждую альтернативу (packages: write,docker/login-action, токены,docker ... push), снизит риск случайной регрессии при будущих правках этого regex без соответствующего изменения тестовой матрицы.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@tests/critical/runtime/image_runtime_contract_test.go` around lines 722 - 723, Добавьте краткий inline-комментарий рядом с writePattern, документирующий назначение каждой альтернативы regex: packages: write, docker/login-action, токены PERSONAL_ACCESS_TOKEN/PAT_TOKEN/GHCR_TOKEN/CR_PAT и команды docker push/--push; также поясните, что continuationPattern нормализует продолжения строк для fail-closed проверки single-writer..agent/specs/macos-cwd-canonical/evidence/MACOS-CWD-CANONICAL.tdd.json (1)
4-4: 🩺 Stability & Availability | 🔵 TrivialВерификация на macOS CI ещё не закрыта.
Артефакт сам фиксирует
"verdict": "PASS_LOCAL_PENDING_MACOS_CI"и"status": "LOCAL_PROXY_GREEN_PENDING_REMOTE_MACOS"— фактическое поведение подтверждено только через Linux TMPDIR-symlink proxy и Windows-прогон, а не реальным macOS-раннером. Учитывая явный запрос автора PR не делать выводы о корректности по «зелёным» тестам и требование exact-head интеграционных доказательств, стоит дождаться и приложить реальный успешный прогонTestCliWorker_ProductionReadinessStructuredArgsAndCWDнаmacos-14перед тем, как считать этот батч закрытым.Also applies to: 39-43
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.agent/specs/macos-cwd-canonical/evidence/MACOS-CWD-CANONICAL.tdd.json at line 4, Обновите артефакт вокруг verdict и status, чтобы не считать батч закрытым до реального успешного macOS CI-прогона TestCliWorker_ProductionReadinessStructuredArgsAndCWD на macos-14. После получения exact-head доказательства замените pending-статусы на отражающие подтверждённый результат и приложите ссылку или идентификатор прогона, сохранив текущие локальные доказательства отдельно.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In
@.agent/specs/release-gates-r12/evidence/release-gates/test-r12-authority-maintenance.ps1:
- Line 355: Исправьте вызовы [regex]::Replace в сценарии, включая участки вокруг
$workflowText и строки 360, 475, 485 и 495: передайте регулярное выражение как
экземпляр [regex] и используйте его метод Replace с аргументом count = 1.
Сохраните текущие шаблоны и замены, чтобы каждый вызов изменял ровно одно
совпадение.
---
Nitpick comments:
In @.agent/specs/macos-cwd-canonical/evidence/MACOS-CWD-CANONICAL.tdd.json:
- Line 4: Обновите артефакт вокруг verdict и status, чтобы не считать батч
закрытым до реального успешного macOS CI-прогона
TestCliWorker_ProductionReadinessStructuredArgsAndCWD на macos-14. После
получения exact-head доказательства замените pending-статусы на отражающие
подтверждённый результат и приложите ссылку или идентификатор прогона, сохранив
текущие локальные доказательства отдельно.
In `@tests/critical/runtime/image_runtime_contract_test.go`:
- Around line 722-723: Добавьте краткий inline-комментарий рядом с writePattern,
документирующий назначение каждой альтернативы regex: packages: write,
docker/login-action, токены PERSONAL_ACCESS_TOKEN/PAT_TOKEN/GHCR_TOKEN/CR_PAT и
команды docker push/--push; также поясните, что continuationPattern нормализует
продолжения строк для fail-closed проверки single-writer.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro
Run ID: b0c9df7f-2126-4d48-9f2a-e384651e4a26
📒 Files selected for processing (26)
.agent/plans/2026-07-10-engram-production-ready-active-diff-contracts.json.agent/specs/macos-cwd-canonical/evidence/MACOS-CWD-CANONICAL.red.json.agent/specs/macos-cwd-canonical/evidence/MACOS-CWD-CANONICAL.tdd.json.agent/specs/release-ci-r1/evidence/RELEASE-CI-R1.red.json.agent/specs/release-ci-r1/evidence/RELEASE-CI-R1.tdd.json.agent/specs/release-ci-r1/evidence/authority-run1.json.agent/specs/release-ci-r1/evidence/authority-run2.json.agent/specs/release-gates-r12/evidence/plan-governance/gates-summary.json.agent/specs/release-gates-r12/evidence/plan-governance/test-r12-plan-governance.ps1.agent/specs/release-gates-r12/evidence/plan-governance/verification-summary.json.agent/specs/release-gates-r12/evidence/release-gates/R12-AUTHORITY-MAINTENANCE.tdd.json.agent/specs/release-gates-r12/evidence/release-gates/maintenance-simulation.json.agent/specs/release-gates-r12/evidence/release-gates/security-review.md.agent/specs/release-gates-r12/evidence/release-gates/test-r12-authority-maintenance.ps1.agent/specs/release-gates-r12/evidence/release-gates/windows-harness.json.github/workflows/authority-guard.yml.github/workflows/test.ymlinternal/handlers/loom/production_readiness_coverage_test.goscripts/production-gates/assert-active-candidate-path-authority.ps1scripts/production-gates/assert-plan-path-ownership.ps1scripts/production-gates/assert-pr-authority-guard.ps1scripts/production-gates/assert-pr-authority-maintenance.ps1scripts/production-gates/compose-secret-access.ps1scripts/production-gates/test-compose-secret-access.ps1scripts/recovery/verify-postgres-backup-restore.ps1tests/critical/runtime/image_runtime_contract_test.go
| foreach ($workflowPath in @('.github/workflows/authority-guard.yml', '.github/workflows/test.yml')) { | ||
| $workflowFile = Join-Path $fixture $workflowPath | ||
| $workflowText = [System.IO.File]::ReadAllText($workflowFile) | ||
| $workflowText = [regex]::Replace($workflowText, '(?m)^on:\s*$', 'on: # parser fixture root-key comment', 1) |
There was a problem hiding this comment.
🎯 Functional Correctness | 🟠 Major | ⚡ Quick win
[regex]::Replace(..., 1) здесь не ограничивает число замен — 1 приводится к RegexOptions.IgnoreCase.
У статического Regex.Replace 4-й аргумент — это RegexOptions, а не count; если нужен ровно один матч, используйте инстанс-метод ([regex]'...').Replace(..., ..., 1). То же относится к строкам 360, 475, 485 и 495.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In
@.agent/specs/release-gates-r12/evidence/release-gates/test-r12-authority-maintenance.ps1
at line 355, Исправьте вызовы [regex]::Replace в сценарии, включая участки
вокруг $workflowText и строки 360, 475, 485 и 495: передайте регулярное
выражение как экземпляр [regex] и используйте его метод Replace с аргументом
count = 1. Сохраните текущие шаблоны и замены, чтобы каждый вызов изменял ровно
одно совпадение.
|
Remote release-gate root cause repaired at exact head 70783ae. GitHub run 29258547103 proved Ubuntu/Windows/macOS PASS but failed before image build because mutable |
🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
cd /tmp
git clone --quiet https://github.com/thebtf/engram.git repo 2>&1 | tail -5 || true
cd repo
git fetch --quiet origin 70783aeca6bda80f8740d510486a02f0ce2488c0 2>&1 | tail -20 || true
git log --oneline -5 70783aeca6bda80f8740d510486a02f0ce2488c0 2>&1 || true
echo "---diff stat against parent 8230a394---"
git diff --stat 8230a3941fa54dac928a71ac79661b8fc072d1ec 70783aeca6bda80f8740d510486a02f0ce2488c0 2>&1 || trueLength of output: 1164 🏁 Script executed: #!/bin/bash
cd /tmp/repo
git diff 8230a3941fa54dac928a71ac79661b8fc072d1ec 70783aeca6bda80f8740d510486a02f0ce2488c0 -- .github/workflows/test.yml
echo "=====RELEASE-CI-R1.tdd.json====="
git diff 8230a3941fa54dac928a71ac79661b8fc072d1ec 70783aeca6bda80f8740d510486a02f0ce2488c0 -- .agent/specs/release-ci-r1/evidence/RELEASE-CI-R1.tdd.jsonLength of output: 11089 🏁 Script executed: #!/bin/bash
cd /tmp/repo
sed -n '1,60p' .github/workflows/test.yml | grep -n "services:" -A 20
echo "---search for services: postgres definition---"
grep -n "postgres:" .github/workflows/test.yml | head -20
grep -n "services:" .github/workflows/test.ymlLength of output: 1142 🤖 web_search executed:
Length of output: 9318 🤖 web_search executed:
Length of output: 15429 🏁 Script executed: #!/bin/bash
cd /tmp/repo
sed -n '1,25p' .github/workflows/test.yml
echo "---job name context---"
grep -n "runs-on" .github/workflows/test.ymlLength of output: 1223 🏁 Script executed: #!/bin/bash
cd /tmp/repo
grep -n "^ [a-zA-Z_-]*:$" .github/workflows/test.yml
echo "---context around Resolve PostgreSQL service identity---"
grep -n "Resolve PostgreSQL service identity" .github/workflows/test.yml
sed -n '1,1p' .github/workflows/test.yml
awk '/^ [a-zA-Z_-]+:$/{print NR": "$0}' .github/workflows/test.ymlLength of output: 647 🏁 Script executed: #!/bin/bash
cd /tmp/repo
grep -n "^ [a-zA-Z0-9_-]*:$" .github/workflows/test.yml
wc -l .github/workflows/test.yml
grep -n "Resolve PostgreSQL" .github/workflows/test.ymlLength of output: 565 🏁 Script executed: #!/bin/bash
cd /tmp/repo
git rev-parse HEAD
git status
git checkout 70783aeca6bda80f8740d510486a02f0ce2488c0 --quiet
wc -l .github/workflows/test.yml
grep -n "Resolve PostgreSQL service identity" .github/workflows/test.yml
grep -n "^ [a-zA-Z0-9_-]*:$" .github/workflows/test.ymlLength of output: 855 🏁 Script executed: #!/bin/bash
cd /tmp/repo
sed -n '17,30p' .github/workflows/test.yml
echo "---step---"
sed -n '860,900p' .github/workflows/test.ymlLength of output: 5239 Good, confirmed: this job (
Root-cause fix looks correct:
Hostile-mutation coverage: the new mutation Evidence file ( No defects found in this delta. I don't see anything blocking here; the remaining open item, as you noted, is the independent rebuild/replay at 70783ae itself. ✅ Action performedReview finished.
|
There was a problem hiding this comment.
Code Review
This pull request implements the R12/B17 trusted authority maintenance system, introducing new validation scripts (assert-pr-authority-guard.ps1 and assert-pr-authority-maintenance.ps1), updated contract audits, and extensive test simulations. It also resolves cross-platform compatibility issues, notably fixing a macOS temporary directory path mismatch in production_readiness_coverage_test.go by using os.SameFile instead of exact string equality, and correcting invalid .NET Directory.SetUnixFileMode calls to use File.SetUnixFileMode across several PowerShell scripts. Feedback on the changes suggests adding directory existence checks before walking .github/workflows and scripts in image_runtime_contract_test.go to prevent test failures in minimal or sparse checkout environments.
Important
The consumer version of Gemini Code Assist on GitHub is being sunset. Starting June 18, 2026, new organization installations will be blocked, and all code review activity will officially cease on July 17, 2026.
For more details on the timeline and next steps, please review the Help Documentation.
| for _, root := range []string{filepath.Join(repo, ".github", "workflows"), filepath.Join(repo, "scripts")} { | ||
| err := filepath.Walk(root, func(path string, info os.FileInfo, err error) error { |
There was a problem hiding this comment.
If the .github/workflows or scripts directory does not exist in the target repository (e.g., in minimal test environments or sparse checkouts), filepath.Walk will return an error immediately and fail the test. It is safer to check if the directory exists before walking it.
| for _, root := range []string{filepath.Join(repo, ".github", "workflows"), filepath.Join(repo, "scripts")} { | |
| err := filepath.Walk(root, func(path string, info os.FileInfo, err error) error { | |
| for _, root := range []string{filepath.Join(repo, ".github", "workflows"), filepath.Join(repo, "scripts")} { | |
| if _, err := os.Stat(root); os.IsNotExist(err) { | |
| continue | |
| } | |
| err := filepath.Walk(root, func(path string, info os.FileInfo, err error) error { |
|
Codex Review: Didn't find any major issues. What shall we delve into next? Reviewed commit: ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. Codex can also answer questions or update the PR. Try commenting "@codex address that feedback". |
There was a problem hiding this comment.
🧹 Nitpick comments (1)
.github/workflows/test.yml (1)
690-694: 🩺 Stability & Availability | 🔵 Trivial | ⚡ Quick winПробел в mutation-тестах: не проверяется экспорт в
GITHUB_ENV.Ассерты на шаге
Resolve PostgreSQL service identityпроверяют наличие привязки кjob.services.postgres.id, вызовdocker inspectи отсутствиеdocker ps --filter, но не проверяют, что строка"POSTGRES_CONTAINER=$container" | Out-File -FilePath $env:GITHUB_ENV(строка 893) осталась в шаге. Если эту строку случайно удалят в будущем PR,$env:POSTGRES_CONTAINERне будет распространён на последующие шаги (в частности, на-PostgresContainer $env:POSTGRES_CONTAINERна строке 916), а текущий hostile-mutation harness (72 отклонённые мутации) этого не поймает — именно та категория регрессии, которую эта PR закрывает для mutable-обнаружения контейнера.Предложение: добавить проверку экспорта в GITHUB_ENV
if ($postgresIdentityStep.Contains('docker ps --filter')) { throw 'PostgreSQL service identity must not be rediscovered by mutable image/tag filters' } + if (-not $postgresIdentityStep.Contains('Out-File -FilePath $env:GITHUB_ENV')) { throw 'PostgreSQL service identity must be republished to GITHUB_ENV for downstream steps' }🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/test.yml around lines 690 - 694, Extend the mutation assertions for the “Resolve PostgreSQL service identity” step to require preservation of the POSTGRES_CONTAINER export to $env:GITHUB_ENV using $container. Keep the existing service-context, docker inspect, and docker ps --filter checks unchanged.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Nitpick comments:
In @.github/workflows/test.yml:
- Around line 690-694: Extend the mutation assertions for the “Resolve
PostgreSQL service identity” step to require preservation of the
POSTGRES_CONTAINER export to $env:GITHUB_ENV using $container. Keep the existing
service-context, docker inspect, and docker ps --filter checks unchanged.
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro
Run ID: 28233da7-09f1-4546-97f2-1adf4ff8be03
📒 Files selected for processing (2)
.agent/specs/release-ci-r1/evidence/RELEASE-CI-R1.tdd.json.github/workflows/test.yml
1 participant
Exact candidate
Head:
8230a3941fa54dac928a71ac79661b8fc072d1ecBase:
review/release-integration-r1This is the combined production-readiness review surface for four previously isolated batches:
Acceptance evidence so far
Required before integration
Do not infer correctness from green tests. Review wrong-type acceptance, raw-vs-normalized values, line continuations, Docker command variants, credential aliases, single-writer sentinel cardinality, and interaction across all four batches.
Summary by CodeRabbit
Новые возможности
Исправления
Тесты