^R D3: migrate copilot prefix-scrub + token-handoff invariants to Go (29 checks)#409
Merged
Conversation
…avior-preserving)
Migrate the contiguous Copilot prefix-scrub + token-handoff invariant
cluster (scripts/verify-invariants.sh lines 8240-8310, 29 checks) to
internal/workcellhardening.CheckCopilotTokenHandoff, following the merged
D3 pattern (evaluate + kinds + per-check targetFile).
Scope stops at line 8310: the next guard (8311) reads a Go source file
(internal/host/hoststate/hoststate.go), a natural topical seam, and
including it would exceed ~30 checks.
- copilot_wrapper prefix-scrub loop (8 checks): emitted wrapper-major
(provider then development) to reproduce the shell's first-failure
order; two affirmative probes (kindPresent) + two duplicate-loop
probes (kindAbsent), message interpolates basename(wrapper).
- Two-file COPILOT_HOME token-copy guard: two ordered kindAbsent checks
(provider-wrapper.sh then home-control-plane.sh) sharing one message.
- Multi-probe || guards (no-auth classifier, handoff-dir, write-site
re-check, leaf permissions, consumed marker): ordered checks sharing
each guard's message; function-block probes span scripts/workcell,
provider-wrapper.sh, and scripts/container-smoke.sh (new path const).
Replace the migrated block with:
go_verify_citools workcell-copilot-token-handoff "${ROOT_DIR}" || exit 1
Tests: table-driven happy path + failing fixture per category + a
real-repo assertion (all 29 needles/paths byte-exact) + a count guard.
Parity: subcommand on real repo exits 0; crafted violations across the
loop, the two-file grep, multi-probe guards, and a different target file
exit 1 with byte-identical messages.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Owner
Author
|
@codex review |
|
Codex Review: Didn't find any major issues. Delightful! Reviewed commit: ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. Codex can also answer questions or update the PR. Try commenting "@codex address that feedback". |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
D3 (migrate verify-invariants.sh to Go) — increment 12 of N (larger batch). Follows #398-#408. Migrates 29 copilot prefix-scrub + token-handoff invariant checks (former lines 8240-8310), replacing a 71-line shell block.
What
internal/workcellhardening: newCheckCopilotTokenHandoff(rootDir)reusingevaluate()+ existing kinds +targetFile(no new kinds). 29 checks acrossscripts/workcell(×15),provider-wrapper.sh(×7),development-wrapper.sh(×4),home-control-plane.sh(×1),container-smoke.sh(×2).cmd/workcell-citools: newworkcell-copilot-token-handoffsubcommand.scripts/verify-invariants.sh: block replaced bygo_verify_citools workcell-copilot-token-handoff "${ROOT_DIR}" || exit 1. Stopped at line 8310 (topical seam; next guard reads a Go source file).Wrinkles handled (parity)
kindPresent, C/D (duplicate OIDC/EXP loops)kindAbsent;basenameinterpolated into each message.COPILOT_HOME): two orderedkindAbsentchecks over the two files sharing the one message.||guards: ordered checks sharing each guard's message, spanning different files via per-checktargetFile(incl.function_block_contains_fixed→kindFunctionBlock).All needles unescaped byte-exact and verified as substrings of their real files; real repo → exit 0. Crafted violations across every category → exit 1 byte-identical. Real-repo assertion + a count=29 guard protect transcription.
Validation
go build/vet/gofmt, fullgo test ./...(table-driven, 12 failing fixtures + real-repo assertion),shellcheck -x,shfmt -d— all green. 4 files / 650 lines.🤖 Generated with Claude Code