F2.1.1: Inspect retained managed mount paths without mutation by omry · Pull Request #326 · omry/reploy

omry · 2026-11-05T08:34:36Z

Add a read-only operation to the existing subordinate setup helper. Verify current root-relative paths against retained descriptors and exact declared metadata through the existing confined lookup. Reuse current authorization, sealed requests, sparse maps, descriptor transport and helper retirement.

Qualify protected subordinate directories and files, parent traversal denial, replacement/missing/link/type/mount refusals, unchanged metadata/content, authorization withdrawal and cancellation. Existing preparation and recipient checks remain valid. No public mapped activation.

Add a read-only operation to the existing subordinate setup helper. Verify current root-relative paths against retained descriptors and exact declared metadata through the existing confined lookup. Reuse current authorization, sealed requests, sparse maps, descriptor transport and helper retirement. Qualify protected subordinate directories and files, parent traversal denial, replacement/missing/link/type/mount refusals, unchanged metadata/content, authorization withdrawal and cancellation. Existing preparation and recipient checks remain valid. No public mapped activation.

gitar-bot · 2026-11-05T08:35:45Z

Code Review ✅ Approved

🟡 Medium risk · Adding descriptor-verified inspection of managed mount paths changes storage setup behavior; a faulty match could admit a replaced path or block valid access.

Adds a read-only inspection operation to the existing subordinate setup helper that verifies retained managed mount paths against descriptors and declared metadata without mutation. No issues found.

Verification

Rules No rules evaluated

Functional validation Not enabled

Set up

_{For more verification details, comment gitar display:verbose.}

Options

Auto-apply is off → Gitar will not commit updates to this branch.
Display: compact → Showing compact verification results.

Comment with these commands to change the behavior for this request:

`Auto-apply`	`Compact`
`gitar auto-apply:on`	`gitar display:verbose`

_{Was this helpful? React with 👍 / 👎 | Powered by Gitar — free for open source}

omry · 2026-11-05T08:46:35Z

PR-cycle state — maintained automatically. Do not edit by hand.

Mechanical PR-cycle state (JSON)

{
  "approval": {
    "candidate_revision_fingerprint": "sha256:bc28c8b8d9ec0ff849abbd0afc41ded53481addc26620f24cc52a75b16596915",
    "evidence": {
      "attestations": [],
      "candidate_revision_fingerprint": "sha256:bc28c8b8d9ec0ff849abbd0afc41ded53481addc26620f24cc52a75b16596915",
      "check_conclusions": [
        {
          "conclusion": "SUCCESS",
          "name": "Bash native evidence checks",
          "run_id": 127145968159
        },
        {
          "conclusion": "SUCCESS",
          "name": "Gitar",
          "run_id": 127137690010
        },
        {
          "conclusion": "SUCCESS",
          "name": "Linux CI checks",
          "run_id": 127137685999
        },
        {
          "conclusion": "SUCCESS",
          "name": "Target smoke (darwin-amd64)",
          "run_id": 127137685808
        },
        {
          "conclusion": "SUCCESS",
          "name": "Target smoke (darwin-arm64)",
          "run_id": 127137685959
        },
        {
          "conclusion": "SUCCESS",
          "name": "Target smoke (linux-amd64)",
          "run_id": 127137686080
        },
        {
          "conclusion": "SUCCESS",
          "name": "Target smoke (linux-arm64)",
          "run_id": 127137685955
        },
        {
          "conclusion": "SUCCESS",
          "name": "Windows host smoke (windows-amd64)",
          "run_id": 127137685794
        },
        {
          "conclusion": "SUCCESS",
          "name": "Windows host smoke (windows-arm64)",
          "run_id": 127137685497
        }
      ],
      "delivery_deferral_ledger_digest": "sha256:4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945",
      "finding_dispositions_digest": "sha256:4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945",
      "operation_identity": "sha256:cfbf1956501b402135f08dbdf37ed736db736f59a0d36f529ce01a69921c354a",
      "review_request": {
        "body_digest": "sha256:2f8d4b958b32144663e98b0031a46f8b7f7afb4722ff67d2a12232358baa969d",
        "id": 6653890168
      },
      "review_result": {
        "body_digest": "sha256:d0f297cec3696140372e07646c4d7850b124826d3fe4b2c9986f823dea4cb6f4",
        "id": 6653921229
      }
    },
    "evidence_fingerprint": "sha256:3b6a68eb642c1e1cb76da63ee51e470031fbc04925a129cce681783c30dedcb7",
    "head_sha": "851f76b2c8df61f7735b682e8e4356183ae90804",
    "operation_identity": "sha256:cfbf1956501b402135f08dbdf37ed736db736f59a0d36f529ce01a69921c354a",
    "review_request_id": 6653890168,
    "review_result_id": 6653921229,
    "status": "approved-evidence-recorded"
  },
  "candidate_revision_fingerprint": "sha256:bc28c8b8d9ec0ff849abbd0afc41ded53481addc26620f24cc52a75b16596915",
  "check_conclusions": [
    {
      "conclusion": "SUCCESS",
      "name": "Bash native evidence checks",
      "run_id": 127145968159
    },
    {
      "conclusion": "SUCCESS",
      "name": "Gitar",
      "run_id": 127137690010
    },
    {
      "conclusion": "SUCCESS",
      "name": "Linux CI checks",
      "run_id": 127137685999
    },
    {
      "conclusion": "SUCCESS",
      "name": "Target smoke (darwin-amd64)",
      "run_id": 127137685808
    },
    {
      "conclusion": "SUCCESS",
      "name": "Target smoke (darwin-arm64)",
      "run_id": 127137685959
    },
    {
      "conclusion": "SUCCESS",
      "name": "Target smoke (linux-amd64)",
      "run_id": 127137686080
    },
    {
      "conclusion": "SUCCESS",
      "name": "Target smoke (linux-arm64)",
      "run_id": 127137685955
    },
    {
      "conclusion": "SUCCESS",
      "name": "Windows host smoke (windows-amd64)",
      "run_id": 127137685794
    },
    {
      "conclusion": "SUCCESS",
      "name": "Windows host smoke (windows-arm64)",
      "run_id": 127137685497
    }
  ],
  "check_observations": [
    {
      "checks": [
        {
          "conclusion": "SUCCESS",
          "name": "Bash native evidence checks",
          "run_id": 127145968159,
          "run_status": "completed",
          "status": "success",
          "url": "https://github.com/omry/reploy/actions/runs/41995542399/job/127145968159"
        },
        {
          "conclusion": "SUCCESS",
          "name": "Gitar",
          "run_id": 127137690010,
          "run_status": "completed",
          "status": "success",
          "url": "https://github.com/omry/reploy/runs/127137690010"
        },
        {
          "conclusion": "SUCCESS",
          "name": "Linux CI checks",
          "run_id": 127137685999,
          "run_status": "completed",
          "status": "success",
          "url": "https://github.com/omry/reploy/actions/runs/41995542399/job/127137685999"
        },
        {
          "conclusion": "SUCCESS",
          "name": "Target smoke (darwin-amd64)",
          "run_id": 127137685808,
          "run_status": "completed",
          "status": "success",
          "url": "https://github.com/omry/reploy/actions/runs/41995542399/job/127137685808"
        },
        {
          "conclusion": "SUCCESS",
          "name": "Target smoke (darwin-arm64)",
          "run_id": 127137685959,
          "run_status": "completed",
          "status": "success",
          "url": "https://github.com/omry/reploy/actions/runs/41995542399/job/127137685959"
        },
        {
          "conclusion": "SUCCESS",
          "name": "Target smoke (linux-amd64)",
          "run_id": 127137686080,
          "run_status": "completed",
          "status": "success",
          "url": "https://github.com/omry/reploy/actions/runs/41995542399/job/127137686080"
        },
        {
          "conclusion": "SUCCESS",
          "name": "Target smoke (linux-arm64)",
          "run_id": 127137685955,
          "run_status": "completed",
          "status": "success",
          "url": "https://github.com/omry/reploy/actions/runs/41995542399/job/127137685955"
        },
        {
          "conclusion": "SUCCESS",
          "name": "Windows host smoke (windows-amd64)",
          "run_id": 127137685794,
          "run_status": "completed",
          "status": "success",
          "url": "https://github.com/omry/reploy/actions/runs/41995542399/job/127137685794"
        },
        {
          "conclusion": "SUCCESS",
          "name": "Windows host smoke (windows-arm64)",
          "run_id": 127137685497,
          "run_status": "completed",
          "status": "success",
          "url": "https://github.com/omry/reploy/actions/runs/41995542399/job/127137685497"
        }
      ],
      "head_sha": "851f76b2c8df61f7735b682e8e4356183ae90804",
      "id": "sha256:8069b41e92db7c0ad01062f2adefe92ef146e2b54e931c01d7adb915c96f9c5f",
      "required_checks": [
        "Bash native evidence checks",
        "Gitar",
        "Linux CI checks",
        "Target smoke (darwin-amd64)",
        "Target smoke (darwin-arm64)",
        "Target smoke (linux-amd64)",
        "Target smoke (linux-arm64)",
        "Windows host smoke (windows-amd64)",
        "Windows host smoke (windows-arm64)"
      ],
      "status": "success"
    }
  ],
  "delivery_deferral_ledger_digest": "sha256:4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945",
  "delivery_deferrals": [],
  "findings": [],
  "pr": {
    "base_ref": "pr325",
    "base_sha": "785c537f0c17df7021c48d54c368ab45a7782cf2",
    "body_digest": "sha256:6f51bf5971324991d63977c864b2187819c4930919205ef8a46cf5351e6ccad7",
    "body_identity_version": 2,
    "diff_digest": "sha256:8ed5722c8e706243900d63cec48198a48e3374e71f5012f465319f8a8d1492ee",
    "head_ref": "pr326",
    "head_sha": "851f76b2c8df61f7735b682e8e4356183ae90804",
    "pr": 326,
    "repository": "omry/reploy",
    "scope_authority": [
      {
        "digest": "sha256:078e63e84d432c2aad03120ca30e40ec4572a8970e6bf6be9d5008608a30f435",
        "path": "docs/MULTI_IDENTITY_D_DESIGN.md"
      },
      {
        "digest": "sha256:7757ebe99b2135d9c7bf78ab29c844c2f1d956420a9fab6fea9dcdd0986f40a8",
        "path": "docs/MULTI_IDENTITY_E_DESIGN.md"
      },
      {
        "digest": "sha256:6f278d93ec80c42f9b905f990c585c1c9db7082cd7e7c2a827e9b840582b6c14",
        "path": "docs/MULTI_IDENTITY_IMPLEMENTATION_PLAN.md"
      },
      {
        "digest": "sha256:78f9f1a1de6098b2b5653c5cd10096e7b0e5023230b1e9365638e317cc64fb95",
        "path": "docs/MULTI_IDENTITY_MAIL_RECONCILIATION.md"
      },
      {
        "digest": "sha256:f6049a45f86b96b5a7c6616926804871d77e8b86bf3305cc42d3910320fc5b76",
        "path": "docs/MULTI_IDENTITY_SECURITY_CONTRACT.md"
      },
      {
        "digest": "sha256:728d53f86612af0d6ba45c3d0fe84e61b41ac5e4f622b43132d2314775e389ab",
        "path": "docs/supporting/MULTI_IDENTITY_IMPLEMENTATION_PLAN/fg-controller-slice-forecast.json"
      },
      {
        "digest": "sha256:3013953a1cafa68f6b1175818a167fab5d61f406970a9f0c61621e23d8809e98",
        "path": "docs/supporting/MULTI_IDENTITY_IMPLEMENTATION_PLAN/fg-prerequisite-audit.md"
      },
      {
        "digest": "sha256:8a073c695effc36a3c2fd2baba3d8fcf85627e152968682154833270da627a5e",
        "path": "docs/supporting/MULTI_IDENTITY_IMPLEMENTATION_PLAN/fg-sizing-basis.md"
      }
    ],
    "title_digest": "sha256:96468fe09a41c138224ef1c622f1fe4276637cc041a12b3e63b89b2364f653a6"
  },
  "record_version": 4,
  "review_observations": [],
  "review_requests": [
    {
      "base_established_at": "2026-11-05T08:34:40Z",
      "base_ref": "pr325",
      "base_sha": "785c537f0c17df7021c48d54c368ab45a7782cf2",
      "body_digest": "sha256:2f8d4b958b32144663e98b0031a46f8b7f7afb4722ff67d2a12232358baa969d",
      "created_at": "2026-11-05T08:57:39Z",
      "head_sha": "851f76b2c8df61f7735b682e8e4356183ae90804",
      "id": 6653890168,
      "kind": "regular-review"
    }
  ],
  "review_results": [
    {
      "base_ref": "pr325",
      "base_sha": "785c537f0c17df7021c48d54c368ab45a7782cf2",
      "body_digest": "sha256:d0f297cec3696140372e07646c4d7850b124826d3fe4b2c9986f823dea4cb6f4",
      "commit_id": "851f76b2c8df61f7735b682e8e4356183ae90804",
      "id": 6653921229,
      "inline_message_ids": [],
      "request_comment_id": 6653890168,
      "result_kind": "clean",
      "status": "result",
      "submitted_at": "2026-11-05T08:59:21Z",
      "unresolved_thread_ids": []
    }
  ],
  "revision_fingerprint": "sha256:bc28c8b8d9ec0ff849abbd0afc41ded53481addc26620f24cc52a75b16596915",
  "rounds": [
    {
      "applied_fix_paths": [],
      "disposition_changes": [],
      "effective_diff_digest": "sha256:8ed5722c8e706243900d63cec48198a48e3374e71f5012f465319f8a8d1492ee",
      "finding_ids": [],
      "invariants": [
        "Inspection reuses the existing fixed helper with exact selected geometry, current owner authorization, confined current-path lookup and retained descriptor/metadata binding.",
        "Inspection never creates, repairs, chowns or adopts data; errors and cancellation close temporary descriptors and retire the helper.",
        "Existing preparation safeguards remain; this helper prerequisite grants no public mapped activation or journal/controller qualification."
      ],
      "outcome": "clean",
      "proposed_fix_paths": [],
      "resulting_head": "851f76b2c8df61f7735b682e8e4356183ae90804",
      "review_observation_id": null,
      "review_request_id": 6653890168,
      "review_result_id": 6653921229,
      "reviewed_head": "851f76b2c8df61f7735b682e8e4356183ae90804",
      "root_cause": "No defect or correction in this round. Exact-head/base-bound Codex review is clean, all8 repository CI jobs plus observed Gitar succeed, all13 fresh local commands pass, and original full independent helper review remains bound to unchanged source and authority.",
      "round": 1,
      "unresolved_current_slice_findings": 0,
      "unresolved_design_blockers": 0
    }
  ],
  "schema": "awd:swe:pr-cycle-state",
  "version": 2
}

chatgpt-codex-connector · 2026-11-05T08:50:41Z

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-11-05T08:59:23.190030Z	`851f76b`	Manual request
🔒 Security Review	✅ Completed 2026-11-05T08:53:18.557480Z	`851f76b`	Draft marked ready

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

omry · 2026-11-05T08:57:39Z

@codex review

Exact head: 851f76b

chatgpt-codex-connector · 2026-11-05T08:59:21Z

Codex Review: Didn't find any major issues. Swish!

Reviewed commit: 851f76b2c8

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

omry changed the base branch from main to pr325 November 5, 2026 08:34

omry mentioned this pull request Nov 5, 2026

F2.1.2: Record managed storage state and transactions #327

Open

omry added this pull request to stack #321 November 5, 2026 08:34

omry marked this pull request as ready for review November 5, 2026 08:50

omry added the approved PR reviewed and approved label Nov 5, 2026

Navigation Menu

Repository navigation

F2.1.1: Inspect retained managed mount paths without mutation - #326

F2.1.1: Inspect retained managed mount paths without mutation#326
omry wants to merge 1 commit into
pr325from
pr326

omry commented Nov 5, 2026 •

edited

Loading

Uh oh!

gitar-bot Bot commented Nov 5, 2026 •

edited

Loading

Uh oh!

omry commented Nov 5, 2026 •

edited

Loading

Uh oh!

chatgpt-codex-connector Bot commented Nov 5, 2026 •

edited

Loading

Uh oh!

omry commented Nov 5, 2026

Uh oh!

chatgpt-codex-connector Bot commented Nov 5, 2026

Uh oh!

This branch has not been deployed

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

omry commented Nov 5, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

gitar-bot Bot commented Nov 5, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

omry commented Nov 5, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

chatgpt-codex-connector Bot commented Nov 5, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codex Review Summary

Uh oh!

omry commented Nov 5, 2026

Uh oh!

chatgpt-codex-connector Bot commented Nov 5, 2026

Uh oh!

This branch has not been deployed

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

omry commented Nov 5, 2026 •

edited

Loading

gitar-bot Bot commented Nov 5, 2026 •

edited

Loading

omry commented Nov 5, 2026 •

edited

Loading

chatgpt-codex-connector Bot commented Nov 5, 2026 •

edited

Loading