Conversation
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: b8cef0524c
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
There was a problem hiding this comment.
Pull request overview
Defines an immutable, portable controlled-session authorization record (with deterministic digesting) and centralizes the container-local runtime identity contract so multiple subsystems share identical validation semantics.
Changes:
- Added
internal/controlledsessionauthorization record validation, handle generation, and canonical digest derivation (plus adversarial tests). - Introduced
internal/runtimeidentityas the shared portable identity contract and validation logic (plus tests). - Refactored blueprint runtime-user validation and Docker sandbox-plan identity validation to reuse the shared runtime identity rules; clarified the lease/ownership boundary in docs.
Reviewed changes
Copilot reviewed 7 out of 7 changed files in this pull request and generated 1 comment.
Show a summary per file
| File | Description |
|---|---|
| internal/runtimeidentity/identity.go | New shared portable runtime identity contract + validation. |
| internal/runtimeidentity/identity_test.go | Unit coverage for identity validation invariants. |
| internal/dockerdeploy/application_sandbox_plan.go | Reuses shared runtime identity validation for sandbox runtime user checks. |
| internal/controlledsession/authorization.go | New immutable controlled-session authorization record validation + digest + handle generation. |
| internal/controlledsession/authorization_test.go | Coverage for authorization validation/digest binding and handle randomness behavior. |
| internal/blueprint/resolve.go | Routes runtime user-name validation through runtimeidentity. |
| docs/CONTROLLED_SESSION_DESIGN.md | Documents the non-transferable connection/lease ownership boundary. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
561ff16 to
6733fd5
Compare
ca5f108 to
c1e9c6a
Compare
6a3c7b0 to
af20e67
Compare
d3b79fc to
c9311b0
Compare
|
@codex review |
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 6e14a39ef1
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
|
@codex review |
|
Codex Review: Didn't find any major issues. 👍 Reviewed commit: ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. Codex can also answer questions or update the PR. Try commenting "@codex address that feedback". |
|
@codex review |
|
Codex Review: Didn't find any major issues. What shall we delve into next? Reviewed commit: ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. Codex can also answer questions or update the PR. Try commenting "@codex address that feedback". |
|
@codex review |
|
Codex Review: Didn't find any major issues. Another round soon, please! Reviewed commit: ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. Codex can also answer questions or update the PR. Try commenting "@codex address that feedback". |
Add immutable session authorization records that bind opaque handles to exact deployments, generations, builds, admitted runs, container plans, runtime identities, controller operations, and declared endpoints. Extract the canonical container runtime identity contract so blueprint resolution, application sandbox planning, and controlled sessions share the same portable user, numeric ID, root-group, and supplementary-group validation. Reuse the deployment live-run ID validator instead of defining another controlled-session grammar. Keep connection ownership and lifetime as non-transferable host lease state: one controller connection owns one admitted live run until disconnect or host cancellation. Document that boundary and prevent authorization digests from implying reconnect or lease extension. Derive canonical authorization digests and add deterministic handle, shared identity, and adversarial validation coverage.
|
@codex review |
|
Codex Review: Didn't find any major issues. Keep it up! Reviewed commit: ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. Codex can also answer questions or update the PR. Try commenting "@codex address that feedback". |
Add immutable session authorization records that bind opaque handles to exact deployments, generations, builds, admitted runs, container plans, runtime identities, controller operations, and declared endpoints.
Extract the canonical container runtime identity contract so blueprint resolution, application sandbox planning, and controlled sessions share the same portable user, numeric ID, root-group, and supplementary-group validation. Reuse the deployment live-run ID validator instead of defining another controlled-session grammar.
Keep connection ownership and lifetime as non-transferable host lease state: one controller connection owns one admitted live run until disconnect or host cancellation. Document that boundary and prevent authorization digests from implying reconnect or lease extension.
Derive canonical authorization digests and add deterministic handle, shared identity, and adversarial validation coverage.
Stack created with Sapling. Best reviewed with ReviewStack.