Repository navigation
Prepare 1.7.10: preserve historical memory and repair hosted client flows - #270
Draft
Coding-Dev-Tools wants to merge 8 commits into
Draft
Coding-Dev-Tools wants to merge 8 commits into
Coding-Dev-Tools wants to merge 8 commits into
Conversation
…nd Code hook - Implement file_guard.py for host-mediated protection of sensitive files - Add Command Code PreToolUse hook integration in integrations/commandcode/file_guard_hook.py - Support --file-guard flag in scripts/install_cc_hook.py with idempotent hook registration - Add documentation in docs/FILE_PROTECTION.md and update SECURITY.md and README.md - Add comprehensive unit tests in tests/test_file_guard.py and tests/test_install_cc_hook.py
Preserve historical validity observations across temporal reads and sync, retain authorized ended-session derivation lineage, and reject mutations prepared before history-only evidence changes. Include reviewed document, dashboard, queue, dependency, packaging and deterministic-evidence fixes. Validation: full Python3.11 suite8348 passed at83.85% coverage; NumPy-only Python3.9 suite6402 passed; focused3.10/3.12/3.13/3.14 matrix, eight eval gates, lint/typechecking, and independently built and installed wheel/sdist checks pass. Hosted and owner-signed release qualification remain separate required gates. The original feature checkout and its starting edits are preserved. This isolated candidate contains the complete tested source checkpoint.
Integrate current main into the isolated release branch while preserving Spec Crawl, Spec Studio, and the unified dashboard. Preserve repeated knowledge-time closures in schema 19 and sync v4; repair Automation round trips, Analytics recovery, and Windows protected-path matching. Qualify the exact source with 10,444 passing Python tests, 156 explained skips, 298 browser checks, reproducible distributions, and installed client journeys. PyPI publication and protected-main merge remain separate.
Preserve a validated local session and its review confirmation without re-emitting request cookie bytes. Keep expired, malformed, forged and explicit-token renewal paths server-signed. Add auth regressions and refresh immutable source-bound benchmark evidence; 245 focused security/dashboard and 139 evidence contracts pass. Keep the unmodified clean CodeQL gate authoritative.
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
Schema 19 preserves append-only validity closures, consistent knowledge-time recall/inspection, and session lineage for governed derivations. Sync v4 transports the closure union while accepting v1–v3 input; older peers must upgrade before receiving v4 bundles.
python "HOOK_PATH"hook recognition so repeated installation and removal remain idempotent without deleting unrelated wrapper commands.v1.7.10README links with the real immutable evidence commitc050d734c55af9fbea8ef299dc80e28cc7c62868.Verification
Current PR head:
d541828b9c18a156bd332acdd519f0aa94e9fc1c, tree529339c01db66f343ea513c9e8c8b06f4fa98511(2,036 files). Its one-file follow-up aligns the existing packaging test's README benchmark pin with the genuine immutable evidence commit. All other 2,035 file records, the 588 producers and the six generated outputs are unchanged.The 11-contract and six-path Ruff checks below ran on
a337adc1ede155b6dbcf76ea2eda94f91f34cfb3/ tree45eed26509cd14984b0f5f41f02c9bfa92c0e0e7. Earlier focused and export/render runs retain their original identities; no local check is retagged as a new run ond541828b.ffaff5b90490ec556c6be33ab57c959c0728a89d. Those four source/test files are byte-identical in the current head; this result retains its original execution identity.a337adc1, all 11 selected documentation/evidence contracts passed with zero skips or errors. Ruff passed on all six affected Python files. Both checks retained their original limits and assertions.ffaff5b90490ec556c6be33ab57c959c0728a89d, three fresh offline fixture runs used Linux CPython 3.12.14 and NumPy 2.4.6. The 588-file producer manifest exactly matches the unchanged producer source. New artifact SHA-256:047cbdfee604c54c2fe211f7cac54a532563ceecadc310f368dec331bf443ce3.The earlier 29 successful automatic jobs, full Python/browser runs, coverage and build artifacts apply to
ff371c07d0ce875473cb78848a38b5cbac27c553/ tree637a3d0a104e85ac2afdccaa4ba2e6454e80acd4and its identical-tree synthetic merge. They are not new-head CI, rebuilt distributions, or live acceptance for the current source.The native GitHub check listing for
d541828breports 30 completed successful checks, including the current Python/browser and packaging jobs. This is hosted evidence for that head, separate from the earlier local runs; it does not establish formal approval or live product acceptance.Release status
This remains a draft. Formal review, complete merge-policy verification and live hosted Pro/Team/full-product qualification remain incomplete. Capacity, recovery, independent quality, usability and pilot acceptance require candidate-bound evidence; the protected qualification environment's required candidate secrets and live acceptance still need verification. Hosted Team memory/MCP and managed Jev remain unavailable.
Main merge, release tags and PyPI publication remain held. No billing cap, runner/account configuration, production grant, or deployment was changed by this repair, and no workflow was manually started or rerun.