chore(review): remove overengineered validation guards

.github/workflows/ci.yml

@@ -14,8 +14,6 @@ on:
           - pinned
           - latest
         default: pinned
-  schedule:
-    - cron: '30 21 * * *'
 
 permissions:
   contents: read
@@ -50,7 +48,7 @@ jobs:
         id: resolve
         env:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          REQUESTED_MODE: ${{ github.event_name == 'schedule' && 'latest' || inputs.upstream_mode || 'pinned' }}
+          REQUESTED_MODE: ${{ inputs.upstream_mode || 'pinned' }}
         run: |
           set -euo pipefail
           source compatibility/upstream.env
@@ -138,7 +136,7 @@ jobs:
 
       - name: Validate Core customization
         env:
-          VALIDATION_RACE: ${{ github.event_name == 'schedule' && '1' || '0' }}
+          VALIDATION_RACE: ${{ needs.resolve-upstream.outputs.mode == 'latest' && '1' || '0' }}
         run: bash customizations-repo/scripts/validation/core.sh upstream-core
 
   source-image-build:

cliproxyapi-pro-management/apply_customizations.py

@@ -225,19 +225,17 @@
     },
 }
 
-def load_overlay_replacement_manifest(path: Path) -> tuple[dict[str, set[str]], dict[str, str]]:
+def load_overlay_replacement_manifest(path: Path) -> dict[str, set[str]]:
     payload = json.loads(path.read_text())
     if payload.get('schemaVersion') != 1 or not isinstance(payload.get('replacements'), list):
         raise RuntimeError(f'Invalid overlay replacement manifest: {path}')
 
     upstream_hashes: dict[str, set[str]] = {}
-    overlay_hashes: dict[str, str] = {}
     for entry in payload['replacements']:
         if not isinstance(entry, dict):
             raise RuntimeError(f'Invalid overlay replacement entry: {entry!r}')
         relative_path = entry.get('path')
         upstream = entry.get('upstreamSha256')
-        overlay = entry.get('overlaySha256')
         if (
             not isinstance(relative_path, str)
             or not relative_path
@@ -247,18 +245,13 @@ def load_overlay_replacement_manifest(path: Path) -> tuple[dict[str, set[str]],
             or not isinstance(upstream, list)
             or not upstream
             or not all(isinstance(item, str) and len(item) == 64 for item in upstream)
-            or not isinstance(overlay, str)
-            or len(overlay) != 64
         ):
             raise RuntimeError(f'Invalid overlay replacement entry: {entry!r}')
         upstream_hashes[relative_path] = set(upstream)
-        overlay_hashes[relative_path] = overlay
-    return upstream_hashes, overlay_hashes
+    return upstream_hashes
 
 
-OVERLAY_REPLACEMENT_HASHES, OVERLAY_REPLACEMENT_SOURCE_HASHES = load_overlay_replacement_manifest(
-    OVERLAY_REPLACEMENTS_FILE
-)
+OVERLAY_REPLACEMENT_HASHES = load_overlay_replacement_manifest(OVERLAY_REPLACEMENTS_FILE)
 
 
 _writes = {}
@@ -370,18 +363,6 @@ def insert_once(path: Path, marker: str, insertion: str, present: str) -> None:
 
 
 def validate_overlay_collisions(target: Path) -> None:
-    if set(OVERLAY_REPLACEMENT_HASHES) != set(OVERLAY_REPLACEMENT_SOURCE_HASHES):
-        raise RuntimeError('Overlay replacement manifest hash maps are inconsistent')
-    for relative_path, expected_digest in OVERLAY_REPLACEMENT_SOURCE_HASHES.items():
-        source = OVERLAY_DIR / relative_path
-        if not source.is_file():
-            raise RuntimeError(f'Overlay replacement source is missing: {source}')
-        actual_digest = hashlib.sha256(source.read_bytes()).hexdigest()
-        if actual_digest != expected_digest:
-            raise RuntimeError(
-                f'Overlay replacement changed without reviewed manifest update: {source} ({actual_digest})'
-            )
-
     for src in OVERLAY_DIR.rglob('*'):
         if src.is_dir():
             continue

cliproxyapi-pro-management/overlay-replacements.json

@@ -10,23 +10,20 @@
       "upstreamSha256": [
         "52cbd98311904f87f588931114b7a708922e2c3d9049da39eb325be5902ee42b"
       ],
-      "overlaySha256": "c96370f6f75f0cfb4a77e6910edaa8762af8337a38f6d1e8c551e37a74772917",
       "reason": "Preserve the reviewed Pro request executor contract."
     },
     {
       "path": "src/utils/quota/resolvers.ts",
       "upstreamSha256": [
         "8fcded3c9edd03ac1f156abdfc37421df2bc0f6bba3717ca13664edd8f837b92"
       ],
-      "overlaySha256": "04fab80ec51e5d0d67ddf8d6332ea3e39d8bd5a337741734974a97d11e1195a0",
       "reason": "Preserve reviewed Pro quota normalization and provider resolution."
     },
     {
       "path": "src/utils/quota/validators.ts",
       "upstreamSha256": [
         "aef0e8b377e569294d5d5f291ce6da10b7b12322516d40f851f2b84521b7840b"
       ],
-      "overlaySha256": "6fa259e36db125eba8753820997e1e6c383488ec30cf5276f046479ce054b754",
       "reason": "Preserve reviewed Pro quota validation semantics."
     }
   ]

cliproxyapi-pro-management/tests/test_overlay_collision_customization.py

@@ -16,12 +16,10 @@ class OverlayCollisionCustomizationTest(unittest.TestCase):
     def setUp(self) -> None:
         self.original_overlay_dir = CUSTOMIZATIONS.OVERLAY_DIR
         self.original_hashes = CUSTOMIZATIONS.OVERLAY_REPLACEMENT_HASHES
-        self.original_source_hashes = CUSTOMIZATIONS.OVERLAY_REPLACEMENT_SOURCE_HASHES
 
     def tearDown(self) -> None:
         CUSTOMIZATIONS.OVERLAY_DIR = self.original_overlay_dir
         CUSTOMIZATIONS.OVERLAY_REPLACEMENT_HASHES = self.original_hashes
-        CUSTOMIZATIONS.OVERLAY_REPLACEMENT_SOURCE_HASHES = self.original_source_hashes
 
     def test_allows_reviewed_replacement_and_idempotent_reapplication(self) -> None:
         with tempfile.TemporaryDirectory() as temp_dir:
@@ -41,9 +39,6 @@ def test_allows_reviewed_replacement_and_idempotent_reapplication(self) -> None:
             CUSTOMIZATIONS.OVERLAY_REPLACEMENT_HASHES = {
                 relative_path.as_posix(): {upstream_hash},
             }
-            CUSTOMIZATIONS.OVERLAY_REPLACEMENT_SOURCE_HASHES = {
-                relative_path.as_posix(): hashlib.sha256(source.read_bytes()).hexdigest(),
-            }
 
             CUSTOMIZATIONS.copy_overlay(target)
             self.assertEqual('customized\n', destination.read_text())
@@ -67,9 +62,6 @@ def test_rejects_unreviewed_upstream_change(self) -> None:
             CUSTOMIZATIONS.OVERLAY_REPLACEMENT_HASHES = {
                 relative_path.as_posix(): {'not-the-current-hash'},
             }
-            CUSTOMIZATIONS.OVERLAY_REPLACEMENT_SOURCE_HASHES = {
-                relative_path.as_posix(): hashlib.sha256(source.read_bytes()).hexdigest(),
-            }
 
             with self.assertRaisesRegex(RuntimeError, 'Upstream overlay replacement changed'):
                 CUSTOMIZATIONS.copy_overlay(target)
@@ -89,7 +81,6 @@ def test_rejects_new_overlay_collision(self) -> None:
 
             CUSTOMIZATIONS.OVERLAY_DIR = overlay
             CUSTOMIZATIONS.OVERLAY_REPLACEMENT_HASHES = {}
-            CUSTOMIZATIONS.OVERLAY_REPLACEMENT_SOURCE_HASHES = {}
 
             with self.assertRaisesRegex(RuntimeError, 'Unexpected overlay collision'):
                 CUSTOMIZATIONS.copy_overlay(target)
@@ -110,36 +101,11 @@ def test_preflight_does_not_copy_other_files_before_rejecting(self) -> None:
 
             CUSTOMIZATIONS.OVERLAY_DIR = overlay
             CUSTOMIZATIONS.OVERLAY_REPLACEMENT_HASHES = {}
-            CUSTOMIZATIONS.OVERLAY_REPLACEMENT_SOURCE_HASHES = {}
 
             with self.assertRaisesRegex(RuntimeError, 'Unexpected overlay collision'):
                 CUSTOMIZATIONS.copy_overlay(target)
             self.assertFalse((target / 'src/new.ts').exists())
 
-    def test_rejects_unreviewed_overlay_replacement_change(self) -> None:
-        with tempfile.TemporaryDirectory() as temp_dir:
-            root = Path(temp_dir)
-            overlay = root / 'overlay'
-            target = root / 'target'
-            relative_path = Path('src/existing.ts')
-            source = overlay / relative_path
-            destination = target / relative_path
-            source.parent.mkdir(parents=True)
-            destination.parent.mkdir(parents=True)
-            source.write_text('changed customization\n')
-            destination.write_text('upstream\n')
-
-            CUSTOMIZATIONS.OVERLAY_DIR = overlay
-            CUSTOMIZATIONS.OVERLAY_REPLACEMENT_HASHES = {
-                relative_path.as_posix(): {hashlib.sha256(destination.read_bytes()).hexdigest()},
-            }
-            CUSTOMIZATIONS.OVERLAY_REPLACEMENT_SOURCE_HASHES = {
-                relative_path.as_posix(): 'not-the-current-overlay-hash',
-            }
-
-            with self.assertRaisesRegex(RuntimeError, 'changed without reviewed manifest update'):
-                CUSTOMIZATIONS.copy_overlay(target)
-
 
 if __name__ == '__main__':
     unittest.main()