Repository navigation
ci+docs: L7 action SHA-pinning, V6/V7/V8 on-device verification, codex plugin add fix - #4
Merged
Merged
Conversation
voidvec
changed the title
wangrh0909
previously approved these changes
Sep 27, 2026
10 处 uses: 由可变 tag/分支改 40 位 commit SHA + 版本注释,均经 commits/<tag> API 剥取核验。新增 tests/test_ci_pinning.py 守卫: 未固定即红、SHA 行缺版本注释即红。主版本不升,属独立变更。
V6 证实(本地 marketplace 根解析 + 快照复制语义,实测后已还原 Codex 环境); V7 渠道分析结案;V8 量化注入体积 5146 字符/1571 CJK≈2465 token,恰在 宿主 ~2500 阈值边缘,降级观察留待登录会话;N4/N5 桌面通道维持待真机。
…nning guard 双代理评审落实: - 真机发现的真缺陷:README×2 与 --host codex 提示教的是不存在的 `codex plugin install …`(0.156.1 实为 `plugin add`),三处更正 + 漂移守卫测试(先 RED 后 GREEN) - 守卫测试收紧:版本注释须为点分版本/release/vN(实证 `# 见 issue 123` 曾骗过宽松断言)、*.yaml glob、引号值/大小写键解析、检测器自身 正反例锁定;publish.yml pypa 注释改时不变形态 "# v1.14.2 (…@2026-09)" - §7 措辞对撞:补探针时序论证(安装后新建→排除就地引用)、SOURCE 列 歧义消解、GitHub 型 marketplace/trust 门禁的外推边界、CJK 统计口径
voidvec
force-pushed
the
ci/backlog-l7-action-pinning
branch
from
September 27, 2026 03:25
412f9a5 to
209c44d
Compare
wangrh0909
approved these changes
Sep 27, 2026
1 of 2 tasks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
第三轮评审遗留 backlog 三项按序清零（独立于 PR #3，基于 master）：
L7 残项 — workflow action 全量 SHA 固定（
c112f03）uses:由可变 tag/分支改为 40 位 commit SHA + 版本注释；每个 SHA 经commits/<tag>API 剥取并等值核验（float tag 现指向恰等于 pin，行为零变化；主版本刻意不升）。tests/test_ci_pinning.py：未固定即红、缺版本注释即红；评审后收紧（点分版本才认、*.yaml、引号值解析、检测器自身正反例）。V6 — Codex
source.path解析基准真机证实（30f3af4+ 报告 §7）source.path:"./"以 marketplace 根解析成立；安装语义=工作区整树"安装时点"快照复制（探针时序实验排除就地引用；.git/build/dist入缓存，452 文件）。核实后环境完整还原。--host codex提示教的是不存在的codex plugin install …（实为plugin add），三处更正 + 漂移守卫测试（412f9a5）。V7 — wheel 执行位渠道分析结案；V8 — session-start 注入量化：5146 字符/1571 CJK≈2465 token，恰在宿主 ~2500 阈值边缘；降级行为需登录会话观察（保持待办），缓解预案已登记。
Test plan
pytest tests/ -q— 157 passed（含守卫 6 例 + codex 命令名漂移 1 例，均先见 RED）check-consistency.py14 项 ✅；sync-assetspy/mjs--check✅；gen-host-artifacts --check✅yaml.safe_load解析通过注意
CHANGELOG.md [Unreleased]有文案性交叠：后合并者需解决一次 trivial 冲突（两段并列即可，内容不互斥）。