Repository navigation
feat(security): add owner freeze controls - #205
Conversation
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 62f6bfdca3
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 6ede77dfb7
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 5f6813642d
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 62ebc37f25
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
|
@codex security review |
🛡️ Codex Security ReviewSecurity review completed. No security issues were found in this pull request. Reviewed commit: Only the user who started this review can view the report in Codex. ℹ️ About Codex security reviews in GitHubThis is an experimental Codex feature. Security reviews are triggered when:
Once complete, Codex will leave suggestions, or a comment if no findings are found. |
PR #205 exposed incomplete history validation and repeated full-history work across live observers, writers and readers. Refine the engineering workflow to test earlier-history corruption, measure complete operations as workloads grow, and verify the scope of delegated audits. Make review findings and verification costs an ongoing source of targeted skill and AGENTS.md improvements. Require applicable skills to be named and read in delegated tasks, preserve independent audits, and replace contradictory guidance rather than accumulate competing rules. Validation: staged documentation verification and diff checks passed. This changes AGENTS.md only; no runtime, workflow, or threat-model changes.
Owners previously had no authenticated API for organization freeze/release, and generic record writes could publish freeze state without owner or predecessor evidence. Add GET/POST
/v1/control/freezeon the private Linux owner socket.The service binds the configured organization and human owner after peer-UID authentication. The typed ledger writer compares the exact current event and version, commits the new state, then cancels matching live contexts. An old release cannot clear a newer hold. Exact duplicate retries return the original committed result; release never revives cancelled work or automatically resumes suspended Tasks.
New records bind the human actor and immediate predecessor to their Event Contract. Generic freeze writes are reserved. Live reads and replay share freeze-chain validation, including buried invalid evidence and orphan/missing event bindings. Legacy records retain their original bytes.
Storage v11 adds organization-scoped observation tokens and fingerprinted triggers for relevant record/event inserts, rewrites, deletes, and replacements. Cold admission validates history before live registration. Active organizations share an immutable validated prefix; each poll reads tok 8000 ens and any appended suffix in one transaction. Unchanged history avoids replay, while rewrites invalidate the proof and unavailable/expired observations fail closed. The freeze writer publishes a cache candidate only after commit. At most eight inactive organization views are retained.
Runtime read and write transactions reuse each organization's validated freeze history across generation, publication, retry, policy, and budget checks. The shared read starter covers inbox polling, knowledge authority snapshots, routing checks, and live inference validation; recovery and reconciliation writers also carry the transaction scope. Each use checks schema and mutation tokens in that exact transaction; its own writes invalidate the proof. Private views cannot escape through rollback or a reused context. Capability, event, and policy validation still perform their required scans and materialize requested admissions. Cold validation and changed-history copying grow with history and remain separate from the live watch pool.
Regression coverage includes authenticated HTTP through SQLite, denied identities and malformed requests, stale/cross-tenant release, duplicate/concurrent retries, cancelled writes, rollback after constructing a valid candidate, cancellation ordering, two handles, restart, legacy upgrade, malformed history, schema drift, and returned-evidence isolation. The real 4,096-revision watchdog regression failed before caching; 32 concurrent live contexts now survive multiple observation windows and honor the next hold. At 16/256/4096 revisions, cached status/idle/interval benchmarks locally measured about 0.025–0.041 ms and 3.7–4.7 KB per operation (30 iterations, no race detector), versus the prior 4096 full-history result of about 490 ms and 228 MB. Query-plan checks cover tenant/event lookup and indexed suffix selection.
The transaction regression reproduces a manifested live inference reservation over 4,096 freeze revisions. A local one-operation comparison reduced its measured allocations from about 825 MB to 135 KB, while an intervening hold still prevents a durable reservation. Same-transaction append/rewrite, rollback, exact-transaction context binding, orphan authority, and returned-evidence isolation have targeted coverage.
Ordinary writes skip irrelevant freeze work before freeze history exists. Related mutation triggers collect all affected organizations before one rewrite-token update per organization, preserving replacement, old/new tenant, and referenced-event invalidation. A Linux race-instrumented write benchmark improved from a median 16.17 ms to 11.34 ms per event-insert/update/record-insert sequence (500 operations, three repetitions). These measurements characterize the fixtures and instrumentation, not a production latency guarantee.
The public inbox regression first reproduced allocation growth from about 18,000 to 288,000 allocations when warmed history grew from 16 to 256 revisions. The fixed read passes the growth check. A 4,096-revision inbox benchmark measured about 12 KB per poll after the fix versus 206 MB before. Real two-handle tests preserve hold/release visibility, other-organization delivery, the original pending message, and rejection of rewritten invalid history.
CI now gives each race-tested Go package twenty minutes. On the same prior head, PR CI passed (ledger 478 seconds) while push CI exceeded Go's default ten-minute package limit; the failed log reported timeouts during SQLite tests, without an assertion or data-race failure. The larger test budget accommodates measured runner variation while preserving every test and race check.
Validation: full Go unit and race suites, build, vet, lint (0 issues), architecture, module consistency, staged document checks, and vulnerability scan (none found) passed on the final Go snapshot. The complete race suite passed under the stricter default ten-minute package limit with all test processes restricted to four CPUs; knowledge took 322 seconds and ledger 425 seconds. Only the CI timeout and its documentation changed after that snapshot; actionlint v1.7.12 passed the final workflow. Hosted checks on the updated head still need to pass. No live provider calls.
Related to #178. Independent abort reliability, complete suspended-task reconciliation/resumption, and remaining coordination/output/effect/timeline coverage remain open. The endpoint is not exposed through the dashboard bridge or A2A listener.