Skip to content

Close kernel conformance freshness and authority gaps - #207

Merged
bigboateng merged 5 commits into
mainfrom
fix/conformance-freshness-authority-guards
Aug 12, 2026
Merged

Close kernel conformance freshness and authority gaps#207
bigboateng merged 5 commits into
mainfrom
fix/conformance-freshness-authority-guards

Conversation

@bigboateng

Copy link
Copy Markdown
Contributor

Summary

  • isolate program-fingerprint staleness from executable mismatch in kernel conformance
  • cover authority expired at resolution and between resolution and apply
  • scan root kernel tests for software-delivery vocabulary with a negative fixture

Motivation

This follows the final review findings on merged PR #205:

Verification

  • 36 Python tests pass (1 expected failure)
  • all 230 sharded Go tests pass
  • go test -race ./kernel/... -count=20 -timeout=3m
  • go vet ./...
  • go build ./...
  • kernel domain-isolation grep and git diff --check

Boatstack Review Trial 1: READY with two closure passes.
Locus: faithful, advisory, forbidden states unreachable, zero blocking states.
Derivation: drv-9f120b09b90f05d37e1cfb202073b74652c2ca9726500752e3c5b4f8f7acd67e

@cursor

cursor Bot commented Aug 12, 2026

Copy link
Copy Markdown

Bugbot is not enabled for your account, so this pull request was not reviewed.

Enable Bugbot in the Cursor dashboard to get automatic reviews on future PRs.

@github-actions github-actions Bot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Codex automated review

Verdict: patch is incorrect
Confidence: 0.98

The new conformance expiry case rejects valid authority lifetimes, while the revised repository verifier misses common Go identifier forms that the prior check caught. Model-level verification is not recommended; both defects have direct deterministic regression tests.

Comment thread boatstack/kernel/conformance/conformance.go Outdated
Comment thread .github/tests/test_repository_contract.py Outdated

@github-actions github-actions Bot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Codex automated review

Verdict: patch is incorrect
Confidence: 0.94

The new verifier can miss forbidden GitHub coupling and can report independent freshness coverage when fixture hooks perturb additional freshness dimensions. Model-level verification is not recommended before merge because these are local verifier defects with direct regression oracles.

Comment thread .github/tests/test_repository_contract.py Outdated
Comment thread boatstack/kernel/conformance/conformance.go

@github-actions github-actions Bot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Codex automated review

Verdict: patch is incorrect
Confidence: 0.96

The freshness and authority conformance additions appear consistent, but the replacement vocabulary verifier regresses soundness. Model-level verification is not recommended for this localized issue.

Comment thread .github/tests/test_repository_contract.py Outdated

@github-actions github-actions Bot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Codex automated review

Verdict: patch is incorrect
Confidence: 0.97

The conformance additions appear internally consistent, but the strengthened domain-neutrality verifier is unsound in both directions: it misses aliased domain-specific imports and rejects valid identifiers in newly scanned test files. Model-level verification is not recommended because the defects are confined to the static verifier.

Comment thread .github/tests/go_source_metadata.go
Comment thread .github/tests/test_repository_contract.py Outdated

@github-actions github-actions Bot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Codex automated review

Verdict: patch is incorrect
Confidence: 0.97

The new source-vocabulary verifier is unsound for import-attached comments and incomplete for valid neutral test identifiers. The conformance freshness and authority changes otherwise show no established defect. Model-level verification is not recommended; these are localized parser/matcher issues.

Comment on lines +62 to +63
case *ast.ImportSpec:
return false

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

[P3] Import-attached comments bypass the vocabulary guard

Invariant: every forbidden domain token in kernel source comments must be detected. A production file containing import "fmt" // repository adapter followed by a normal fmt use passes domain_vocabulary_hits: returning false for *ast.ImportSpec skips its Doc and Comment children, while fmt contributes no import-path hit. The previous raw-source check rejected this token, so the bypass is introduced here and makes the domain-neutrality CI guard unsound. Add a fixture with an import-line comment and require a repository hit; inspect import comments while excluding only the path literal.

Confidence: 0.99

Comment on lines +56 to +58
for root, token in DOMAIN_NEUTRAL_ROOTS:
if normalized == root or normalized.startswith(root):
return token

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

[P3] Prefix matching rejects neutral branching tests

Invariant: the domain-neutrality verifier must accept identifiers using branch in its ordinary control-flow sense. Adding boatstack/kernel/relation_test.go with func TestBranchingCandidates(t *testing.T) now fails CI: Branching is split as one component and startswith("branch") classifies it as a Git branch reference. This is introduced because the patch extends vocabulary scanning to _test.go files. The observable impact is that valid kernel tests cannot merge. Add a fixture expecting no hits for TestBranchingCandidates, and match semantic identifier components rather than arbitrary root prefixes.

Confidence: 0.96

@bigboateng
bigboateng merged commit 4208aa1 into main Aug 12, 2026
17 checks passed
@bigboateng
bigboateng deleted the fix/conformance-freshness-authority-guards branch August 12, 2026 17:23
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant