You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Continue #1033 on the current fail-closed probe and close the remaining evidence-classification gap: curl's %{http_code}000 sentinel is not a completed HTTP exchange and must not be logged as a three-digit status.
Prefer this branch over #897, #1033, #1041, and #1042 for integration. Those PRs remain historical or incomplete evidence. Keep #821 draft. Do not close#810 until a protected-main public consumer run proves a non-200 or failed-transfer comparison cannot produce a green Dependency Review gate.
What changed
The support probe classifies curl 000 and an empty status as unavailable before any three-digit HTTP status is accepted.
Executable regressions cover private and internal visibility labels, raw untrusted visibility non-leakage, and curl exit 6 with printed 000.
Doctoring now cites curl write-out semantics (Stenberg, n.d.) and GitHub's documented 403 meaning (private without Advanced Security, or a fork comparison) so operators verify entitlement instead of inferring not-applicable.
Acceptance
Merge only after exact-current-head deterministic, security, dependency, and required workflows are terminal and clean, current automated review has no valid unresolved finding, and a qualifying counted non-author formal approval exists.
Automated review is not qualifying approval or merge authority.
Operator next step
Mark this pull request ready if it opens as draft, then wait for exact-current-head required checks.
Leave a counted non-author formal approval on this head only.
Replay unique #897 source onto current origin/main. Skip shared
ARCHITECTURE/CLAUDE trees. Treat non-200 or failed transport as
unavailable evidence rather than a clean skip.
Close the remaining #810 diagnostic gap:
allowlist public/private/internal/unknown visibility in probe
diagnostics, execute 403/404/empty/malformed regressions, and stop
making the pinned action independently skippable after a successful
probe.
Co-authored-by: Seongho Bae <seonghobae@users.noreply.github.com>
Add executable regressions for the EgressWeave #66 canary (HTTP 403
skip-was-success), a bare transport failure, and curl exit 18 with a
printed 200. Record exact SHAs and allowlisted visibility without
leaking the probe token.
Co-authored-by: Seongho Bae <seonghobae@users.noreply.github.com>
…arness
Invoke the extracted support probe with an absolute bash path and keep
the fake curl first on PATH so isolated executable regressions can run
without calling the real binary.
Co-authored-by: Seongho Bae <seonghobae@users.noreply.github.com>
Classify curl's no-status 000 write-out as unavailable instead of a
three-digit HTTP code, and lock private/internal visibility plus raw
visibility non-leakage with executable regressions.
Co-authored-by: Seongho Bae <seonghobae@users.noreply.github.com>
The reason will be displayed to describe this comment to others. Learn more.
Stale comment
Verdict
COMMENT on exact head 37167995.
This successor classifies curl 000 as unavailable dependency-review evidence, keeps private/internal visibility labels, and proves raw visibility strings cannot leak into diagnostics. Local contract: tests/test_required_workflow_queue_contract.py 62 passed.
Operator next step
Mark this pull request ready for review if it is still a draft, so CodeRabbit and the merge scheduler can see the head.
Wait only for exact-current-head required checks and a counted non-author formal approval.
The reason will be displayed to describe this comment to others. Learn more.
Remaining gap on 37167995
The 000 classification is correct. A named revision still goes green.
GitHub's dependency-graph compare API resolves {base}...{head} named revisions to the current HEAD of that name. On this head, HEAD_SHA=main plus a synthetic HTTP 200 writes supported=true and would reach the pinned action against a moving revision. Empty base SHAs and owner/../ repository values have the same path.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
Purpose
Continue #1033 on the current fail-closed probe and close the remaining evidence-classification gap: curl's
%{http_code}000sentinel is not a completed HTTP exchange and must not be logged as a three-digit status.Prefer this branch over #897, #1033, #1041, and #1042 for integration. Those PRs remain historical or incomplete evidence. Keep #821 draft. Do not close #810 until a protected-main public consumer run proves a non-200 or failed-transfer comparison cannot produce a green Dependency Review gate.
What changed
000and an empty status asunavailablebefore any three-digit HTTP status is accepted.000.403meaning (private without Advanced Security, or a fork comparison) so operators verify entitlement instead of inferringnot-applicable.Acceptance
Merge only after exact-current-head deterministic, security, dependency, and required workflows are terminal and clean, current automated review has no valid unresolved finding, and a qualifying counted non-author formal approval exists.
Automated review is not qualifying approval or merge authority.
Operator next step