feat(lab): CL-10 public evidence operator and community integration - #1706
Conversation
|
Important Review skippedAuto reviews are disabled on base/target branches other than the default branch. 🗂️ Base branches to auto review (2)
Please check the settings in the CodeRabbit UI or the ⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: ASSERTIVE Plan: Pro Plus Run ID: You can disable this status message by setting the Use the checkbox below for a quick retry:
📝 WalkthroughWalkthroughThis PR defines and implements CL-10 public evidence export. It adds privacy-safe projection, Ed25519 signing, bounded community import, revocation, provenance-aware purge, CLI and management API surfaces, Compatibility Matrix context, and validation tests. Remote publishing remains unavailable. ChangesCL-10 public evidence lifecycle
Estimated code review effort: 5 (Critical) | ~120 minutes Merge Risk: 🟡 Moderate · up to This PR adds local public-evidence and community workflows, but a stale process lock can make community operations unavailable until manual cleanup, an over-capacity cache can block reads and imports, and large record totals can lose integer precision. A test fault is also not restored when assertions fail, which can contaminate later tests. These bounded issues should be fixed or explicitly accepted before merge. Sequence Diagram(s)sequenceDiagram
participant Operator
participant PublicEvidenceOperator
participant ManagementAPI
participant CommunityStorage
participant CompatibilityMatrix
Operator->>PublicEvidenceOperator: preview or export selected evidence
PublicEvidenceOperator->>PublicEvidenceOperator: project, validate, and sign bundle
Operator->>ManagementAPI: verify or import bundle
ManagementAPI->>CommunityStorage: validate and persist quarantined evidence
CompatibilityMatrix->>ManagementAPI: fetch community context
ManagementAPI-->>CompatibilityMatrix: return untrusted bundle and record summaries
Possibly related PRs
Suggested reviewers: 🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✨ Finishing Touches 💡 2📝 Generate docstrings 💡
🛠️ Fix failing CI checks 💡
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
|
✅ Deterministic PR hygiene checks passed. |
✅ READY
UI screenshot waived by the Hygiene✅ Deterministic PR hygiene checks passed. |
Wibias
added
the
gui-screenshot-waived
Rebase the reviewed CL-10 operator/community layer onto the current public-evidence core. This squashes the child history onto cl10-public-core while preserving the exact conflict-free GitHub merge tree, including the final review fixes.
c54b36d to
2a709df
Compare
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
This comment was marked as resolved.
This comment was marked as resolved.
Sorry, something went wrong.
This comment was marked as resolved.
This comment was marked as resolved.
Sorry, something went wrong.
2 participants
Stack
2/2 - operator/community layer stacked on #1705.
This PR restores the former #1510 branch on top of the restored trust-core base.
Summary
Implements CL-10.1 through CL-10.4 on the reviewed public-evidence contract: privacy-safe projection, canonical signed local exports, explicit local operator surfaces, and isolated non-authoritative community verification/revocation context.
CL-10.5 remote publishing is deliberately not implemented. It remains blocked until an exact service origin, transport, security, retention, and revocation contract is independently reviewed and accepted.
Scope
CL-10.1 - public projection and trust boundary
PublicEvidenceRecordV1/PublicEvidenceBundleV1schemasCL-10.2 - canonical bundles, signatures, and local storage
public_exportauthorityCL-10.3 - explicit local operator surfaces
ocx lab public previewocx lab public exportocx lab public verify <file>with nonzero exit on invalid evidenceCL-10.4 - community verification and revocation
community_untrusted_v1/ not-local-verdict semanticsTrust isolation
Community evidence remains non-authoritative:
Explicit non-scope
/api/lab/public/publishendpointocx lab public publishcommandpublic_exportauthority existsStack order
cl10-public-core->devfeat/cl-10-public-evidence-contract->cl10-public-coreRestores the branch previously reviewed in #1510 without merging that closed PR.
Summary by CodeRabbit