Skip to content

fix(sync,manifest): record sync authorization denial and support public-offer cloud contract - #306

Open
Coding-Dev-Tools wants to merge 5 commits into
mainfrom
fix/sync-and-manifest-hardening
Open

Coding-Dev-Tools wants to merge 5 commits into
mainfrom
fix/sync-and-manifest-hardening

Conversation

@Coding-Dev-Tools

@Coding-Dev-Tools Coding-Dev-Tools commented Nov 2, 2026 •

Copy link
Copy Markdown
Owner

Summary

This PR addresses release-readiness edge cases in \engraphis\ for Pro and Team features:

  1. Sync Authorization Denial & Account Recovery URL: In \engraphis/routes/v2_api.py\ (\sync_run), when all attempted workspaces fail due to authorization loss (ā, 402, 403), the API now calls _record_authoritative_denial()\ so local license status and UI badges settle immediately, and returns \licensing.account_url()\ when connected (matching \hosted_client.py\ and \GET /api/sync/status) to prevent lapsed Team customers from being misrouted to the default Pro checkout URL.
  2. Commercial Manifest Cloud Contract Validation: In \scripts/check_commercial_manifest.py, accept \schema == 'engraphis-public-offer/v1'\ alongside \schema_version == 1\ so --cloud-contract\ cross-repo validation cleanly passes against \engraphis-cloud/engraphis_cloud/public_offer_contract.json.
  3. Tests: Added regression test in \ ests/test_sync_dashboard.py. All commercial hardening and sync dashboard tests pass locally.

Agent: antigravity

…ic-offer cloud contract

- Record authoritative entitlement denial when POST /api/sync/run fails with 401/402/403, and return account_url() when connected to prevent lapsed Team users from misrouting to Pro checkout
- Accept schema 'engraphis-public-offer/v1' in scripts/check_commercial_manifest.py --cloud-contract to cleanly validate against engraphis-cloud
- Add regression test in tests/test_sync_dashboard.py

Agent: antigravity
@chatgpt-codex-connector

Copy link
Copy Markdown

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review Status Commit Review trigger
📝 Code Review ⚠️ Failed 2026-11-02T23:22:21.938856Z
We couldn’t complete this review. Comment @codex review to try again.
ba75758 PR opened
ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

@chatgpt-codex-connector

Copy link
Copy Markdown

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.

@Coding-Dev-Tools

Copy link
Copy Markdown
Owner Author

The failing gate is tests/test_benchmark_evidence.py:435 with a fixture mismatch. This branch predates the 1.7.12 fixture refresh. PR #304 contains the same sync and manifest hardening changes plus the refreshed fixture, and its full check suite is green. Recommend closing #306 after #304 lands; I did not close or merge it.

Coding-Dev-Tools and others added 4 commits November 3, 2026 06:07
The registered artifact binds the SHA-256 of every Python file under
engraphis/ and eval/, so the sync authorization-denial change in
engraphis/routes/v2_api.py invalidated it. test_benchmark_evidence.py failed
the same assertion on Python 3.10 through 3.14, in the numpy-only 3.9 core
floor job, and in the coverage gate, which was the single shared cause of
every red job on this PR.

Regenerate the immutable artifact with scripts/export_offline_evidence (new
basename, 590-file manifest, identical deterministic fixture aggregates) and
re-pin the artifact SHA-256 and the fixture-suite digest in README,
BENCHMARKS, and both rendered SVG/PNG pairs. The PNGs are rasterized at their
exact canvas sizes through headless Chromium because this host has no
libcairo; the repo's own metadata writer still binds both checksums.

Also pass retention_supervisor="none" to the chunking fixture service. Its
background supervisor pruned memories while the fixture ran, so the reported
context reduction drifted between 71.1 and 72.3 percent and a fresh run could
not reproduce a recorded artifact.

Co-authored-by: CommandCodeBot <noreply@commandcode.ai>
regenerate/normalize rather than use the host checkout bytes: engraphis/routes/v2_api.py was rewritten with CRLF by a Windows editor, so the artifact recorded the CRLF digest while every Linux CI checkout hashes the LF blob (.gitattributes pins *.py to eol=lf). That single stale entry broke test_benchmark_evidence.py on Python 3.10-3.14, the numpy-only 3.9 core floor, and the coverage gate. Normalize the producer file to LF, re-record its digest, recompute the suite digest, and re-pin the artifact SHA plus both PNG provenance chunks.

Co-authored-by: CommandCodeBot <noreply@commandcode.ai>
Resolve the benchmark evidence surfaces to main's 1.7.12 release artifact, which already binds the sync authorization-denial producer bytes, and drop the superseded local re-pin of the previous artifact.

Co-authored-by: CommandCodeBot <noreply@commandcode.ai>

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant