Repository navigation
fix(storage): bind historical backups across validation heartbeats - #5794
Conversation
Part of #5793. Compare validated identity, scope, readiness and credentials while requiring complete native responses. Preserve replacement and credential-change rejection.
At 047f006, 156 affected race tests passed across the native catalogue and protected command packages; golangci-lint reported zero issues and the whitespace check passed. The observation-level validation-heartbeat case failed before the fix and passes now. Separate tests continue rejecting credential changes, replacement identities, missing resource versions, wrong scope, unusable state, incomplete reads and expired observations. Self-review covered correctness, simplification and security. Each native response still must contain complete validated metadata and the expected scope, state and credentials. The private digest now commits those decoded facts; it excludes resource-version bookkeeping and unconsumed validation timestamps. The former changed-binding tests now use a replaced UID rather than treating a heartbeat as identity replacement, preserving the actual safety test. Secret data remains only in the private in-memory comparison; no digest or credential is added to public receipts. Native runtime evidence remains a failed observation at deployment-changed, with no accepted preservation receipt. Read-only non-secret API observations corroborated validation metadata advancing while identity and repository configuration stayed the same. Protected post-merge observation is still required; catalogue metadata alone proves neither historical recoverability nor permission to reset a disk. |
Part of #5793. Remove the secret-derived digest identified by CodeQL and compare all credential values in constant time, separately from non-credential state.
At 40c1034, the CodeQL finding's secret-derived SHA-256 comparison has been removed. Credentials are compared directly in memory, using separate constant-time comparisons for the access key, secret key and repository password. Non-credential validated state is compared separately. No secret-derived digest remains in this binding path. The affected race suite passes 159 cases across two packages, including independent changes to every credential, all four object replacements, validation heartbeat stability, incomplete reads and result withholding. Lint reports zero issues. Current-head hosted security and CI readback are still required; the failed old-head alert is not dismissed or treated as passed. Actual post-merge catalogue acceptance remains pending. |
Part of #5665. Hosted run 41551806702 exhausted the old four-minute wrapper during cold Kubernetes dependency compilation. Build the unchanged native proof separately within a bounded setup phase, retain its two-minute test timeout, and cap both phases below the existing twenty-minute package deadline.
…et-5665' into codex/longhorn-binding-stability-5793
Current head c8e0aa6 non-destructively integrates reviewed main and the focused native admission-proof budget fix from #5799. The catalogue correction is unchanged. All three affected packages pass with race detection: the catalogue, its actual command and the complete native benchmark admission wrapper. Lint and whitespace checks pass. The body was freshly seeded, checked and read back successfully. Correctness, security and simplification self-review found no remaining issue. Production catalogue acceptance remains pending actual merge and a new protected first attempt. The prior failed hosted run is preserved. #5799 now has a clean Codex review and passing hosted full Go regressions; its native admission proof completed in 183.20 seconds. No failed attempt was rerun or check suppressed. The merge-order note keeps that fix separately delivered before this PR. CodeRabbit availability was re-read directly from #5792 (comment). The authenticated 01:10:12 UTC event explicitly scopes the quota to this public repository and places the next included review 54 minutes later, at 02:04:12 UTC. No redundant request is sent during that window. Continuing to Codex at this head; quota is not a review pass. |
@codex review |
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
|
Codex Review: Didn't find any major issues. Nice work! Reviewed commit: ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. Codex can also answer questions or update the PR. Try commenting "@codex address that feedback". |
Evaluated head c8e0aa6: all 51 check contexts are settled without failures, including CI41558743134 and CodeQL. Three affected packages pass with race detection after the non-destructive integration of #5799. The regression reproduces ordinary controller heartbeat changes, permits them after validation, and still rejects every bound object replacement, missing resource version and credential rotation. Credential values are compared only in memory, without a hash or serialized catalogue value. Lint, formatting and whitespace checks pass. Codex completed a clean exact-head review: summary #issuecomment-6592873194 and receipt #issuecomment-6592883881. The complete conversation, review and inline-comment inventories have no unresolved findings or maintainer instructions. CodeRabbit's applicable repository quota was verified before using the next lane. The published body passes its readback check, the source claim is current, and GitHub reports CLEAN. Readable required gates pass; the configured code-quality rule remains unreadable and is left to the protected merge API. Live platform health passes. Delivery remains sequenced after #5799. Native historical-catalogue acceptance requires actual merge and a new protected-main observation; no catalogue, backup-content equivalence, restoration or reset clearance is claimed here. This PR is not being enqueued ahead of the pending fixed-selection host and disk observations. |
Why
The historical backup check mistakes routine validation updates for deployment changes and withholds results needed for the storage migration.
What
Confirm that the repository, readiness, credentials and object identities stay the same while allowing routine controller bookkeeping to advance. Real changes still stop the check.
Merge order: land #5799 first so the cold-run validation fix remains a separate delivery.
Part of #5793