fix(conformance): distinguish Cave record mismatches - #165
Merged
Conversation
Contributor
There was a problem hiding this comment.
🟡 Changes recommended
validateCaveRecord currently compares ranAt without validating it is a canonical ISO timestamp string, allowing non-string/coerced values to bypass the new bounded timing checks.
Once you've addressed the issues Copilot identified, you can request another Copilot review.
Pull request overview
This PR refines Phase 1 conformance diagnostics by splitting the previously coarse Cave record mismatch failure into specific, allowlisted diagnostic IDs, and updates the conformance lock / workflow pins to match the new immutable authority checkpoints.
Changes:
- Split Cave record mismatch failures into bounded diagnostic IDs (identity / timing / assertions) and ensure wrapper allowlists include them.
- Add a dedicated test suite to assert the new diagnostics propagate through both producer/public wrappers and reject private suffixes.
- Update conformance lock authority hashes, workflow source pins, and documentation to reflect the new reachable checkpoints and diagnostic taxonomy.
File summaries
| File | Description |
|---|---|
src/phase1-schema-v2-evidence.test.ts |
Adds tests asserting bounded Cave record diagnostics and wrapper behavior. |
src/phase1-conformance-lock.test.ts |
Updates expected authority revision/tree/blob+sha256 pins. |
scripts/phase1-schema-v2-producer.mjs |
Extends public diagnostic allowlist for schema-v2 producer wrapper. |
scripts/phase1-schema-v2-evidence.mjs |
Implements the split Cave record validation diagnostics and exports validateCaveRecord. |
scripts/phase1-schema-v2-evidence.d.mts |
Declares the new exported validateCaveRecord API. |
scripts/phase1-conformance.mjs |
Extends public diagnostic allowlist for public wrapper. |
phase1-conformance.lock.json |
Updates locked harness authority checkpoints. |
docs/phase1-conformance.md |
Documents the new bounded Cave record diagnostics and updates pinned SHA-256 values. |
.github/workflows/client-v1-conformance.yml |
Updates protected workflow source hash pins for conformance verification. |
Review details
- Files reviewed: 9/9 changed files
- Comments generated: 1
- Review effort level: Lite
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
Comment on lines
+1174
to
+1179
| if (caveRecord.ranAt < expected.startedAt) { | ||
| throw new Error('phase1.stage.evidence-authority.build.cave-record.timing.before-run'); | ||
| } | ||
| if (caveRecord.ranAt > expected.completedAt) { | ||
| throw new Error('phase1.stage.evidence-authority.build.cave-record.timing.after-run'); | ||
| } |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Linux reaches evidence assembly but currently emits only
phase1.stage.evidence-authority.build.cave-record. Report fixed identity-field, timing-bound, and assertion-condition IDs through both wrappers. Reject private diagnostic suffixes and expose no record values, assertion IDs, or private causes.Also reject malformed/noncanonical Cave timestamps before range comparisons; review identified that null and numeric values could otherwise bypass the existing JavaScript comparisons. Identity checks, inclusive timing bounds, assertion requirements, frozen production sources, dependencies, and resource limits remain unchanged.
Update protected workflow hashes and the immutable authority graph. Use a real merge commit, not squash/rebase, so executable authority cd2f5a3 remains reachable. SDK rebinding and a protected run are required before identifying Linux's failing condition.
Validation: 17 red-to-green diagnostic regressions; evidence suite 41 passed / 42 existing optional SDK-fixture skips; TypeScript and Biome passed. Verified all 25 governed Git blobs/digests and 36 literal workflow source pins. Broad harness/lock run: 398 passed / 2 skipped, with one fixture-cleanup failure caused by an empty directory left by an interrupted run. The directory was removed; the failed test and three exact-authority regressions then passed on the final commit. No test or production timeouts were increased.