Repository navigation
Enable Vision's guarded temporary GitHub credential - #135
Conversation
|
Important
This repository does not receive automatic reviews because it has fewer than 10 stars. ⚙️ Run configurationConfiguration used: Repository: ayhammouda/python-docs-mcp-server/.coderabbit.yaml Review profile: CHILL Plan: Advanced Run ID:
Comment |
|
Navigate logical layers of code changes, visualize relationships, and explore their blast radius. No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Repository: ayhammouda/python-docs-mcp-server/.coderabbit.yaml Review profile: CHILL Plan: Advanced Run ID: ⛔ Files ignored due to path filters (5)
📒 Files selected for processing (1)
Included review availability: This review used your included allowance. Your plan provides up to 1 included review per hour; 0 remain after this review. 📝 WalkthroughWalkthroughThe test suite adds coverage for temporary-token authentication, verification receipts, and temporary-to-App activation lifecycle behavior. ChangesVision control tests
Priority: ⬇️ Low Estimated code review effort: 2 (Simple) | ~10 minutes Change: Feature Merge Risk: ⚪ Minimal · up to This change adds regression tests for temporary authentication, verification receipts, and activation lifecycle behavior. It does not alter runtime behavior, and no actionable merge-blocking risk was found in the supplied test changes. Security Architecture ReviewSecurity architecture risk: 🟡 Moderate · up to Credentials remain behind a restricted broker, and merges require trusted verification. However, operator activation is not coordinated with in-flight broker operations, weakening the guarantee that disabling readiness stops writes. Live deployment confirmation remains incomplete. Retained concerns
Security review detailsSecurity Blast Radius
Security Findings and Attack Paths
Trust Boundaries and Controls
Hardening Proposals
🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✨ Finishing Touches 💡 1📝 Generate docstrings 💡
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
|
Vision — automated project maintainer Independent verification (temporary credential): failure Head: {
"approved": false,
"summary": "ValueError: Independent reviewer did not approve complete current-head evidence"
} |
|
Vision — automated project maintainer Independent verification (temporary credential): failure Head: {
"approved": false,
"summary": "ValueError: Independent review rejected: [\"No trusted evidence establishes Aymen's authorization to use the existing account-scoped credential or replace the verifier-App merge gate. The owner rationale and PR text cannot establish that authority.\", 'The new tests mock verification and do not exercise temporary credential capture, file permissions, or the App-transition lifecycle. Live broker acceptance evidence is still pending.']"
} |
|
Vision — automated project maintainer Independent verification (temporary credential): failure Head: {
"approved": false,
"summary": "ValueError: Independent review rejected: ['Host policy omitted configured MCP tools for this run. Report to the operator; no MCP-backed work was performed.']"
} |
|
Vision — automated project maintainer Independent verification (temporary credential): success Head: {
"head_sha": "2111a2d4f87b90296a0aae50a2779a3cd36e70c1",
"base_sha": "5b00c0e131a4338fc37fb65790a58138b23c2bc4",
"approved": true,
"summary": "Reviewed the complete six-file diff against current main. Temporary authentication keeps the credential in the root-owned broker, binds merge receipts to head, main and installed policy, and blocks releases; the MCP scoping change preserves tested existing restrictions. Fresh locked checks passed. The first full test run had 536 passes and one conditional skip; a repeat passed all 537. All 11 hosted checks passed. Product regression used a cached docs index, so this run does not evidence a fresh index build. The owner\u2019s target-host canary and credential-permission claims were not independently accessible.",
"commands": [
{
"command": "git clone --depth=1 https://github.com/ayhammouda/python-docs-mcp-server.git repo",
"exit_code": 0
},
{
"command": "git fetch --depth=1 origin 2111a2d4f87b90296a0aae50a2779a3cd36e70c1 5b00c0e131a4338fc37fb65790a58138b23c2bc4",
"exit_code": 0
},
{
"command": "git diff --check 5b00c0e131a4338fc37fb65790a58138b23c2bc4 2111a2d4f87b90296a0aae50a2779a3cd36e70c1",
"exit_code": 0
},
{
"command": "/usr/local/bin/uv sync --locked --dev",
"exit_code": 0
},
{
"command": "/usr/local/bin/uv run --locked ruff check src/ tests/ benchmarks/ ops/ .github/scripts/",
"exit_code": 0
},
{
"command": "/usr/local/bin/uv run --locked pyright src/ benchmarks/",
"exit_code": 0
},
{
"command": "/usr/local/bin/uv run --locked pytest --tb=short -q",
"exit_code": 0
},
{
"command": "/usr/local/bin/uv run --locked pytest --tb=short -q -rs",
"exit_code": 0
},
{
"command": "/usr/local/bin/uv run --locked pytest tests/test_vision_control.py -q",
"exit_code": 0
},
{
"command": "/usr/local/bin/uv run --locked python -m benchmarks validate-corpus --corpus docs/benchmarks/corpus.yml --schema docs/benchmarks/corpus.schema.json",
"exit_code": 0
},
{
"command": "/usr/local/bin/uv build",
"exit_code": 0
}
],
"blockers": []
} |
1 participant
Vision needs to keep working while GitHub App registration is deferred. The operator-authorized temporary mode captures Vision's existing credential in the root-owned broker, restricted to this repository. Workers never receive it.
Independent prepublication review remains mandatory. Temporary merge authorization requires a private receipt bound to the exact PR head, current main and installed broker policy. Public review comments cannot authorize a merge; all eleven required GitHub checks and resolved review conversations still apply. Releases remain disabled until App activation removes the temporary credential.
The installer scopes host MCP servers away from the project agents before discovery, preserving other configured agents' access and existing restrictions. This removes a false incomplete-MCP blocker without granting workers host connectors.
Validation: 537 local tests, Ruff and Pyright pass. All eleven required hosted checks pass on
2111a2d4f87b90296a0aae50a2779a3cd36e70c1. Focused independent static reviews found no blockers. Live checks confirmed root-only credential access, broker PR creation, refusal to merge without a private receipt, and a fresh verifier session without the MCP warning. Full independent verification and the SHA-matched broker merge are recorded separately on this PR. GitHub App positive-path validation remains deferred until registration.