Conversation
Doogie201
added
evidence:attached
risk:high
operator-grade
Codecov Report✅ All modified and coverable lines are covered by tests. 📢 Thoughts on this report? Let us know! |
Bundle ReportBundle size has no change ✅ |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: acf89d25ee
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| export function assertEvidenceSources(sources, label, minimumCount) { | ||
| if (!Array.isArray(sources) || sources.length < minimumCount) { | ||
| throw new Error(`${label} evidence sources incomplete`); | ||
| } | ||
| for (const source of sources) { | ||
| ensureKeys(source, ['id', 'path', 'kind', 'section'], `${label} evidence source`); | ||
| if (typeof source.id !== 'string' || typeof source.path !== 'string' || typeof source.kind !== 'string' || typeof source.section !== 'string') { | ||
| throw new Error(`${label} evidence source fields must be strings`); |
There was a problem hiding this comment.
assertEvidenceSources now only validates key presence and string types, and the three long-range truth validators (project_state_summary, architecture_snapshot, epoch_closeout) rely on it as their evidence-source gate in check mode. Because this commit also removed generator byte-parity checks, a committed artifact can carry stale or wrong evidence_bundle paths (for example, pointing to another sprint or a nonexistent index) and still pass verification, which undermines the historical-rollup hardening goal.
Useful? React with 👍 / 👎.
1 participant
Summary
Evidence
Gates