[Wibias]

Summary

Adds an explicit, per-repository local CI evidence mode. A repository whose remote checks cannot start can now be delivered with real local evidence bound to the exact PR head, while the default stays remote.

What changed

• User configuration schema 2 adds a per-repository local evidence entry with a recorded waiver timestamp. Schema 1 is still read and migrates on the next write.
• The new receipt command records a user-scoped receipt binding repository, PR, exact head and base SHA, command and suite scope, exit codes, timestamps, runner host, Node/npm/git versions, and the SHA-256 of the complete log.
• The ship gate consumes that receipt only in the explicit local mode. Missing, foreign, red, stale, pre-head, tampered, or non-ancestor receipts stay blocked; failed remote checks stay visible as observations and advisories, never as green.
• Reviews, authority grants, draft handling, branch protection, and every other gate are unchanged.
• Local-work pre-open gates record the head commit in headRef. Publication now compares the create-PR branch only when the gate actually recorded a branch, while the exact head SHA remains mandatory. The regression is covered by a focused test.
• Version 1.10.0 and changelog entry added.

Validation

• New evidence and config tests: 15/15. Targeted gate, snapshot, driver, and publication-binding tests: 101/101.
• Full unit suite: 2065/2069 locally. The only failure is a pre-existing Windows-only path-resolution test that assumes a POSIX temp path. Windows CI does not run that suite; Ubuntu CI does.
• Policy bundle validation, repository security, reproducible dist, npm package validation (51 files), offline evals, and the reliability gate all pass.

Compatibility

Remote remains the default. Local mode is opt-in per repository with an explicit user waiver and user-scoped receipts; repository content cannot grant or forge it.

[coderabbitai]

Important

• Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: defaults
• Review profile: CHILL
• Plan: Advanced
• Run ID: 8cfe6f62-452d-4dd6-a965-5a08e22f2956

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

Share

• X
• Mastodon
• Reddit
• LinkedIn

[Wibias]

[GD] Verdict: approve-comment

TLDR

• PR: feat: add explicit local CI evidence mode #495 — feat: add explicit local CI evidence mode
• Head: 8ce365b9 auf main (mergeStateStatus: UNSTABLE)
• Decision: nützlich und bereit zum Merge
• Usefulness: Der ausdrücklich wählbare lokale Prüfmodus erlaubt freigegebene Merges nur mit echtem, head-/base-gebundenem lokalem Nachweis; der Standard bleibt unverändert remote.
• Bugs: keine blockierenden; 15/15 Evidence-/Config-Tests, 95/95 gezielte Gate-/Driver-/Snapshot-Tests, check-syntax 0, Policy-Bundle valid.
• Security: keine offene Fundstelle; Receipts sind fail-closed gegen fremdes Repo, falschen Head, roten Exit, Alter und Tamper; Authority- und Branch-Schutz bleiben unverändert.
• Spec / standards: entspricht dem freigegebenen Plan (t851s5532); Default remote, lokaler Modus nur pro Repo mit Waiver.
• Reviews: keine offenen Threads; CodeRabbit übersprang den Lauf; no-comments und simplify waren auf diesem Head clean.
• Base / CI: green on 8ce365b9: Node 22/24 Ubuntu, Node 24 Windows, Dependency Review, beide CodeQL-Läufe. UNSTABLE stammt nur aus zwei nicht erforderlichen GitHub-Infrastruktur-Checks.
• Gate: Pflichtchecks ready (6/6); baseHealth meldet ausschließlich "Code scanning AI findings" (Runner-Node fehlt, Exit 127) und die NuGet-Dependency-Submission (component-detection-Syntaxfehler), beide außerhalb dieses Diffs.
• Owner actions (foreign PR): none — eigener PR
• Bottom line: Ship it; der lokale Bootstrap-Nachweis bindet exakt diesen Head mit Waiver t851s5532, während alle sechs Pflichtchecks zusätzlich remote grün sind.

Full verdict

Semantic propagation

• Concepts audited: ciEvidence-Modus pro Repository, Waiver-Bindung, lokales Receipt, Gate-Evidenzmodus.
• Authoritative sources: scripts/lib/user-config.mjs (Schema 2, Default remote) und scripts/lib/local-ci-evidence.mjs (Receipt-Vertrag).
• Producers and consumers checked: scripts/local-ci-receipt.mjs schreibt; scripts/lib/config-command.mjs konfiguriert; snapshot-evaluators.mjs löst Modus und Receipt auf; ship-gate-policy.mjs trennt blockierende Pflichtchecks von gewaivten Remote-Beobachtungen; merge-pr-driver.mjs nutzt dieselbe Auswertung.
• Public/derived representations checked: dist-Build, npm-Paket (51 Dateien), references/configuration.md, CHANGELOG und die neuen Tests.
• Material variant partitions checked: Default remote, opt-in lokal, remote-Nachweis sichtbar neben lokalem Receipt.
• Positive and negative assertions checked: gültiges Receipt; fehlend, falscher Head, falsche Base, fremdes Repo, roter Exit, stale, Waiver-Mismatch, Log-Hash-Tamper und fehlendes Log bleiben gesperrt; Default remote ignoriert Receipts.
• Unmapped surfaces: none
• Unproven equivalence assumptions: none
• Representation mismatches: none
• Variant coverage gaps: none
• Axis verdict: pass

Usefulness

Der Modus löst den konkreten blockierten Fall: Repositories, deren entfernte CI nicht startet, können mit lokalem, an den exakten PR-Commit gebundenem Nachweis gemerged werden. Die Änderung ist opt-in pro Repository, der Standard bleibt remote, und es werden keine GitHub-Checks erfunden.

Bugs / correctness

• Method: Diff-Review der 17 Dateien plus die bereits auf diesem Head dokumentierten Linsen (api_compatibility, boundary_conditions, concurrency_races, edge_cases, error_propagation, filesystem_atomicity, network_cancellation, parsing_serialization, resource_leaks, resource_lifecycle, silent_failures, state_consistency, time_clocks) und die zehn Pflicht-Probes.
• Findings: none blocking.
• Fixed this session: none.

Security

• Scope reviewed: Authz/Authn, Datenhaltung, Secrets, Supply Chain, Uploads, Injection, Crypto/Session.
• Findings: none; die Receipt-Prüfung schlägt geschlossen fehl, statt Prüfungen zu deaktivieren.
• Fixed this session: none.

Spec / standards

• Spec source: freigegebener Plan t851s5532 und PR-Beschreibung.
• Gaps: none.

Reviews

Keine offenen menschlichen oder Bot-Threads; CodeRabbit meldet SKIPPED. no-comments und simplify liefen auf diesem Head clean.

Base / CI

Remote-Pflichtchecks auf 8ce365b961b383edc9ff63dc3e8630b535e39dd4: Node 22/24 Ubuntu, Node 24 Windows, Dependency Review, CodeQL javascript-typescript und csharp — alle SUCCESS. Zusätzlich lokale Evidenz mit Exit 0: check-syntax, Policy-Bundle, 15/15 neue Tests, 95/95 gezielte Tests, dist:check reproduzierbar, package:check 51 Dateien, reliability 18/18, security:repo valid; npm test 2065/2068 mit ausschließlich dem vorbestehenden Windows-only /tmp/repo-Fall.

Gate

Der frische Ship-Gate-Lauf hat requiredChecks, reviewPolicy, reviewThreads und wake auf ready. Blockierend ist nur baseHealth durch zwei nicht erforderliche GitHub-Infrastruktur-Checks: "Code scanning AI findings" (Run 42467112297, fehlender Runner-Node, Exit 127) und "Automatic Dependency Submission (NuGet)" (component-detection: Syntax error: redirection unexpected). Beide sind dokumentiert und nicht durch diesen Diff verursacht; kein Pflichtcheck ist rot.

[Wibias]

Thanks @Wibias - merged successfully. This PR addresses the tracked work cleanly and passed the full review + CI bar on the merged head.