Bind verified Windows token-profile regression - #224
Merged
Conversation
Contributor
There was a problem hiding this comment.
🟡 Changes recommended
Include the refreshed compressed Windows fixture or restore the existing integrity expectations.
Get a fresh assessment by requesting another Copilot review.
Pull request overview
Rebinds SDK conformance evidence to Chat #241’s verified merge and refreshes related Windows regression expectations and documentation.
Changes:
- Updates producer, harness, signer, and source identity pins.
- Refreshes Windows regression fixture expectations.
- Updates conformance, release, and workflow documentation.
A critical issue remains: the referenced refreshed Windows fixture bytes are not included, so the updated integrity expectations will fail against the existing fixture.
File summaries
| File | Description |
|---|---|
tests/conformance-gaps.spec.ts |
Updates producer and Windows fixture expectations. |
tests/conformance-contract.spec.ts |
Pins the new producer and harness identities. |
RELEASING.md |
Documents the refreshed regression and release status. |
docs/workflows/client-v1-cross-repository-conformance.md |
Updates workflow binding guidance. |
conformance/client-v1-cross-repository-lock.json |
Rebinds the frozen evidence producer. |
Review details
- Files reviewed: 5/6 changed files
- Comments generated: 1
- Review effort level: Lite
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
Comment on lines
+1905
to
+1908
| 186_680, | ||
| ); | ||
| expect(sha256(TEST_WINDOWS_SUPERVISOR_TEST)).toBe( | ||
| '6348c9d127a405bb93c008d28fe6bdf12879abd97a9242b7b95e9009430c0922', | ||
| '4d72ab77e9f1e3d442b5e0bffd7b920e53fa28548a22b53f7e6226bd9b19df4a', |
9 tasks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Bind the SDK conformance validator to Chat #241's actual signed merge
11606c2f91b3523d2e362143234731cd7e664a1cand frozen harness7d2b855eb4112dcb93d530c5d54f26601e201b6b. Refresh the producer identities, native Windows regression fixture, contract expectations, and release documentation.The regression queries the isolated process token profile and proves SYSTEM or Administrators ownership before exercising discovery. Its owner probe and discovery RPC use separate Jobs. Unknown ACL metadata remains unavailable and rejected. Validator security logic and other source pins are unchanged.
Validation:
corepack pnpm@10.34.0 verifypassed: normal and coverage suites each 1,513 passed / two skipped; typecheck, builds, contract and package verification, development-release checks, stress, and lint passed.After verified SDK landing, rotate both validator scopes to the actual merge and obtain fresh protected validation. Protected platform evidence and release acceptance remain outstanding. No public package behavior change; changeset not applicable.
Review finding 3997315810 was checked against GitHub's immutable blob
87d95b68ef91f36616c084cd20c157079c27e79d: the refreshed compressed fixture is included in this PR. It decompresses to 186,680 bytes with SHA2564d72ab77e9f1e3d442b5e0bffd7b920e53fa28548a22b53f7e6226bd9b19df4a, matching the expectations and immutable Chat source. No patch is required for that finding.