didericis/bot-bottle
1
0
Fork 0
Code Issues 33 Pull Requests 9 Actions Packages Releases Wiki Activity

fix: quality cleanup - execution and secret integrity (chunk 9/11) #530

Closed
didericis-codex wants to merge 1 commits from fix/cleanup-execution-integrity into fix/authoritative-cleanup-identities
pull from: fix/cleanup-execution-integrity
merge into: didericis:fix/authoritative-cleanup-identities
Conversation 0 Commits 1 Files Changed 19
+206 -101
didericis-codex commented 2026-07-26 23:58:07 -04:00
Collaborator
Copy Link
Copy Source

Stacked on #528. Ninth quality-cleanup chunk tracked by #444 and PRD 0082.

  • No legacy secret downgrade: only versioned encrypt-then-MAC ciphertext is accepted. Registry migration v6 intentionally clears existing persisted agent-secret rows; local agents must be recreated/reprovisioned.
  • Approval intersection: the shared cleanup contract executes only resources present in both the operator-visible plan and the authoritative post-confirmation snapshot.
  • Complete mutation diagnostics: a shared cleanup failure accumulator attempts every approved mutation and reports partial failures instead of silently claiming success.
  • Git failure containment: git http-backend spawn and timeout failures return a deterministic HTTP 503.

Validation: Focused affected suites and repository-wide Pyright pass. The complete eleven-PR stack passes all 2,520 unit tests; full-repository Pyright reports 0 errors; git diff --check passes.

Refs #444.

Final stack extension

  • #531 — bounded heavy Git and cleanup operations.

Final stack extension

  • #532 — fail-closed shared database and gateway credential permissions.
Stacked on #528. Ninth quality-cleanup chunk tracked by #444 and PRD 0082. - **No legacy secret downgrade:** only versioned encrypt-then-MAC ciphertext is accepted. Registry migration v6 intentionally clears existing persisted agent-secret rows; local agents must be recreated/reprovisioned. - **Approval intersection:** the shared cleanup contract executes only resources present in both the operator-visible plan and the authoritative post-confirmation snapshot. - **Complete mutation diagnostics:** a shared cleanup failure accumulator attempts every approved mutation and reports partial failures instead of silently claiming success. - **Git failure containment:** `git http-backend` spawn and timeout failures return a deterministic HTTP 503. **Validation:** Focused affected suites and repository-wide Pyright pass. The complete eleven-PR stack passes all 2,520 unit tests; full-repository Pyright reports 0 errors; `git diff --check` passes. Refs #444. **Final stack extension** - #531 — bounded heavy Git and cleanup operations. **Final stack extension** - #532 — fail-closed shared database and gateway credential permissions.
didericis force-pushed fix/cleanup-execution-integrity from 50fc706c3a to f0f14ea5de 2026-07-27 00:17:25 -04:00 Compare
didericis-codex changed title from fix: quality cleanup - execution and secret integrity (chunk 9/9) to fix: quality cleanup - execution and secret integrity (chunk 9/10) 2026-07-27 00:26:13 -04:00
didericis added 1 commit 2026-07-27 00:47:06 -04:00
fix: enforce cleanup and secret integrity
test / image-input-builds (pull_request) Failing after 11m32s
Details
test / unit (pull_request) Has started running
Details
test / coverage (pull_request) Blocked by required conditions
Details
test / integration-docker (pull_request) Blocked by required conditions
Details
tracker-policy-pr / check-pr (pull_request) Failing after 12m21s
Details
95cbd0e1c8
didericis force-pushed fix/cleanup-execution-integrity from f0f14ea5de to 95cbd0e1c8 2026-07-27 00:47:06 -04:00 Compare
didericis-codex changed title from fix: quality cleanup - execution and secret integrity (chunk 9/10) to fix: quality cleanup - execution and secret integrity (chunk 9/11) 2026-07-27 00:50:31 -04:00
didericis-codex closed this pull request 2026-07-27 01:36:00 -04:00
Some checks are pending
test / image-input-builds (pull_request) Failing after 11m32s
Details
test / unit (pull_request) Has started running
Details
test / coverage (pull_request) Blocked by required conditions
Details
test / integration-docker (pull_request) Blocked by required conditions
Details
tracker-policy-pr / check-pr (pull_request) Failing after 12m21s
Details

Pull request closed

Please reopen this pull request to perform a merge.
Sign in to join this conversation.
Reviewers
No Reviewers
Labels
Clear labels
Compat/Breaking
Breaking change that won't be backward compatible
 Kind/Bug
Something is not working
 Kind/Documentation
Documentation changes
 Kind/Enhancement
Improve existing functionality
 Kind/Feature
New functionality
 Kind/Security
This is security issue
 Kind/Testing
Issue or pull request related to testing
Priority
Critical
1
The priority is critical
Priority
High
2
The priority is high
Priority
Low
4
The priority is low
Priority
Medium
3
The priority is medium
Status
Abandoned
3
Somebody has started to work on this but abandoned work
Status
Blocked
1
Something is blocking this issue or pull request
Status
Need More Info
2
Feedback is required to reproduce issue or to continue work
Status/Needs Triage
Awaiting initial classification
No Label
Milestone
No items
No Milestone
Assignees
Clear assignees
didericis-claude (didericis (claude)) didericis-codex (didericis (codex)) didericis-gemma (gemma) didericis
No Assignees
2 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: didericis/bot-bottle#530
Delete Branch "fix/cleanup-execution-integrity"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?