[arbiter-authentication/2.10.3] Prepared reuse and single activation by omry · Pull Request #79 · omry/arbiter

omry · 2026-10-30T17:35:01Z

Preserve a selected portable agent identity through target preparation and activation. The target binds approval to the exact registered issuer revision, issues its own access credentials, and commits the result and unique agent binding in one transaction. A denied or inactive target binding blocks another enrollment.

Validate the selected identity before the client sends ready, and recover the exact committed target result after a lost reply or restart. Recheck portable certificate validity after account evaluation, before authorizing a new commit. Public registration and CLI source selection remain on the fresh flow until the next planned slice.

Validation: 1,853 Python tests passed (43 skipped), 20 portable-focused tests passed, explicit full formatting and lint/type checks passed, and Go tests/vet passed. Real Python/Go peers cover A offline, B restart, lost replies and changed-certificate rejection. The expiry regression fails against the original activation code and passes with this fix. Native CI and remote review are separate publication gates.

omry · 2026-10-30T17:41:03Z

PR-cycle state — maintained automatically. Do not edit by hand.

Mechanical PR-cycle state (JSON)

{
  "approval": {
    "candidate_revision_fingerprint": "sha256:6c049421d076d6e2bdb10660bb0a12b44ea52604aa165617ac76f16826fac35b",
    "evidence": {
      "attestations": [],
      "candidate_revision_fingerprint": "sha256:6c049421d076d6e2bdb10660bb0a12b44ea52604aa165617ac76f16826fac35b",
      "check_conclusions": [
        {
          "conclusion": "SUCCESS",
          "name": "Gitar",
          "run_id": 124255453727
        },
        {
          "conclusion": "SUCCESS",
          "name": "Platform Linux arm64",
          "run_id": 124255476572
        },
        {
          "conclusion": "SUCCESS",
          "name": "Platform Linux x64",
          "run_id": 124255476566
        },
        {
          "conclusion": "SUCCESS",
          "name": "Platform Windows arm64",
          "run_id": 124255477037
        },
        {
          "conclusion": "SUCCESS",
          "name": "Platform Windows x64",
          "run_id": 124255476764
        },
        {
          "conclusion": "SUCCESS",
          "name": "Platform macOS arm64",
          "run_id": 124255476691
        },
        {
          "conclusion": "SUCCESS",
          "name": "Platform macOS x64",
          "run_id": 124255476720
        },
        {
          "conclusion": "SUCCESS",
          "name": "Python 3.10",
          "run_id": 124255477012
        },
        {
          "conclusion": "SUCCESS",
          "name": "Python 3.11",
          "run_id": 124255476538
        },
        {
          "conclusion": "SUCCESS",
          "name": "Python 3.12",
          "run_id": 124255476732
        },
        {
          "conclusion": "SUCCESS",
          "name": "Python 3.14",
          "run_id": 124255476700
        },
        {
          "conclusion": "SUCCESS",
          "name": "Python lint",
          "run_id": 124255475843
        },
        {
          "conclusion": "SUCCESS",
          "name": "Website",
          "run_id": 124255476357
        }
      ],
      "delivery_deferral_ledger_digest": "sha256:4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945",
      "finding_dispositions_digest": "sha256:4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945",
      "operation_identity": "sha256:7026286fe43fc24a9ab1d973cb30e33ee4d080ae75e101292ea60b899084c0f7",
      "review_request": {
        "body_digest": "sha256:6ef1821efbf57bc1bf8ef3c38b099243447d5512b61ce23909bd0d40a7996868",
        "id": 6531477412
      },
      "review_result": {
        "body_digest": "sha256:c5f03ba63b600572b02226bdfd5da7f6363a3a96906de4961e8df9cbef944f5e",
        "id": 6531503844
      },
      "security_review": {
        "context_identity": "sha256:1f8558b86868c4619187996726164d8220198161fb17f3e41415c52b4b648eb2",
        "proof_identity": "sha256:4577777ce4b2ca64127dc8e1008ac9b09175b3eedb58d2919777a2d2ca6616f7",
        "requested": "dbb",
        "schema_version": 1
      }
    },
    "evidence_fingerprint": "sha256:b22b97b9f3ef7ba6d8ad562360d4a562671f6889f0d130f6ab1d4aa91c877850",
    "head_sha": "e144661ff7049451365f0dccc80ba840f39d3433",
    "operation_identity": "sha256:7026286fe43fc24a9ab1d973cb30e33ee4d080ae75e101292ea60b899084c0f7",
    "review_request_id": 6531477412,
    "review_result_id": 6531503844,
    "status": "approved-evidence-recorded"
  },
  "candidate_revision_fingerprint": "sha256:6c049421d076d6e2bdb10660bb0a12b44ea52604aa165617ac76f16826fac35b",
  "check_conclusions": [
    {
      "conclusion": "SUCCESS",
      "name": "Gitar",
      "run_id": 124255453727
    },
    {
      "conclusion": "SUCCESS",
      "name": "Platform Linux arm64",
      "run_id": 124255476572
    },
    {
      "conclusion": "SUCCESS",
      "name": "Platform Linux x64",
      "run_id": 124255476566
    },
    {
      "conclusion": "SUCCESS",
      "name": "Platform Windows arm64",
      "run_id": 124255477037
    },
    {
      "conclusion": "SUCCESS",
      "name": "Platform Windows x64",
      "run_id": 124255476764
    },
    {
      "conclusion": "SUCCESS",
      "name": "Platform macOS arm64",
      "run_id": 124255476691
    },
    {
      "conclusion": "SUCCESS",
      "name": "Platform macOS x64",
      "run_id": 124255476720
    },
    {
      "conclusion": "SUCCESS",
      "name": "Python 3.10",
      "run_id": 124255477012
    },
    {
      "conclusion": "SUCCESS",
      "name": "Python 3.11",
      "run_id": 124255476538
    },
    {
      "conclusion": "SUCCESS",
      "name": "Python 3.12",
      "run_id": 124255476732
    },
    {
      "conclusion": "SUCCESS",
      "name": "Python 3.14",
      "run_id": 124255476700
    },
    {
      "conclusion": "SUCCESS",
      "name": "Python lint",
      "run_id": 124255475843
    },
    {
      "conclusion": "SUCCESS",
      "name": "Website",
      "run_id": 124255476357
    }
  ],
  "check_observations": [
    {
      "checks": [
        {
          "conclusion": "SUCCESS",
          "name": "Gitar",
          "run_id": 124215691362,
          "run_status": "completed",
          "status": "success",
          "url": "https://github.com/omry/arbiter/runs/124215691362"
        },
        {
          "conclusion": "SUCCESS",
          "name": "Gitar",
          "run_id": 124217362501,
          "run_status": "completed",
          "status": "success",
          "url": "https://github.com/omry/arbiter/runs/124217362501"
        },
        {
          "name": "Platform Linux arm64",
          "run_id": 124215688364,
          "run_status": "in_progress",
          "status": "pending",
          "url": "https://github.com/omry/arbiter/actions/runs/41100084538/job/124215688364"
        },
        {
          "name": "Platform Linux x64",
          "run_id": 124215688406,
          "run_status": "in_progress",
          "status": "pending",
          "url": "https://github.com/omry/arbiter/actions/runs/41100084538/job/124215688406"
        },
        {
          "name": "Platform Windows arm64",
          "run_id": 124215688373,
          "run_status": "in_progress",
          "status": "pending",
          "url": "https://github.com/omry/arbiter/actions/runs/41100084538/job/124215688373"
        },
        {
          "name": "Platform Windows x64",
          "run_id": 124215688331,
          "run_status": "in_progress",
          "status": "pending",
          "url": "https://github.com/omry/arbiter/actions/runs/41100084538/job/124215688331"
        },
        {
          "name": "Platform macOS arm64",
          "run_id": 124215688339,
          "run_status": "in_progress",
          "status": "pending",
          "url": "https://github.com/omry/arbiter/actions/runs/41100084538/job/124215688339"
        },
        {
          "name": "Platform macOS x64",
          "run_id": 124215688358,
          "run_status": "in_progress",
          "status": "pending",
          "url": "https://github.com/omry/arbiter/actions/runs/41100084538/job/124215688358"
        },
        {
          "conclusion": "FAILURE",
          "name": "Python 3.10",
          "run_id": 124215688380,
          "run_status": "completed",
          "status": "failure",
          "url": "https://github.com/omry/arbiter/actions/runs/41100084538/job/124215688380"
        },
        {
          "conclusion": "SUCCESS",
          "name": "Python 3.11",
          "run_id": 124215688442,
          "run_status": "completed",
          "status": "success",
          "url": "https://github.com/omry/arbiter/actions/runs/41100084538/job/124215688442"
        },
        {
          "conclusion": "SUCCESS",
          "name": "Python 3.12",
          "run_id": 124215688319,
          "run_status": "completed",
          "status": "success",
          "url": "https://github.com/omry/arbiter/actions/runs/41100084538/job/124215688319"
        },
        {
          "conclusion": "SUCCESS",
          "name": "Python 3.14",
          "run_id": 124215688551,
          "run_status": "completed",
          "status": "success",
          "url": "https://github.com/omry/arbiter/actions/runs/41100084538/job/124215688551"
        },
        {
          "conclusion": "SUCCESS",
          "name": "Python lint",
          "run_id": 124215688156,
          "run_status": "completed",
          "status": "success",
          "url": "https://github.com/omry/arbiter/actions/runs/41100084538/job/124215688156"
        },
        {
          "conclusion": "SUCCESS",
          "name": "Website",
          "run_id": 124215688449,
          "run_status": "completed",
          "status": "success",
          "url": "https://github.com/omry/arbiter/actions/runs/41100084538/job/124215688449"
        }
      ],
      "head_sha": "893b4302769ce445823cdcdc214b9763ba92cba4",
      "id": "sha256:44ff2deae3551c812fd15c4335a30ed9291796f9a3892262f2661d94e32b5e32",
      "required_checks": [
        "Gitar",
        "Platform Linux arm64",
        "Platform Linux x64",
        "Platform Windows arm64",
        "Platform Windows x64",
        "Platform macOS arm64",
        "Platform macOS x64",
        "Python 3.10",
        "Python 3.11",
        "Python 3.12",
        "Python 3.14",
        "Python lint",
        "Website"
      ],
      "status": "failure"
    },
    {
      "checks": [
        {
          "conclusion": "SUCCESS",
          "name": "Gitar",
          "run_id": 124255453727,
          "run_status": "completed",
          "status": "success",
          "url": "https://github.com/omry/arbiter/runs/124255453727"
        },
        {
          "conclusion": "SUCCESS",
          "name": "Platform Linux arm64",
          "run_id": 124255476572,
          "run_status": "completed",
          "status": "success",
          "url": "https://github.com/omry/arbiter/actions/runs/41111818916/job/124255476572"
        },
        {
          "conclusion": "SUCCESS",
          "name": "Platform Linux x64",
          "run_id": 124255476566,
          "run_status": "completed",
          "status": "success",
          "url": "https://github.com/omry/arbiter/actions/runs/41111818916/job/124255476566"
        },
        {
          "conclusion": "SUCCESS",
          "name": "Platform Windows arm64",
          "run_id": 124255477037,
          "run_status": "completed",
          "status": "success",
          "url": "https://github.com/omry/arbiter/actions/runs/41111818916/job/124255477037"
        },
        {
          "conclusion": "SUCCESS",
          "name": "Platform Windows x64",
          "run_id": 124255476764,
          "run_status": "completed",
          "status": "success",
          "url": "https://github.com/omry/arbiter/actions/runs/41111818916/job/124255476764"
        },
        {
          "conclusion": "SUCCESS",
          "name": "Platform macOS arm64",
          "run_id": 124255476691,
          "run_status": "completed",
          "status": "success",
          "url": "https://github.com/omry/arbiter/actions/runs/41111818916/job/124255476691"
        },
        {
          "conclusion": "SUCCESS",
          "name": "Platform macOS x64",
          "run_id": 124255476720,
          "run_status": "completed",
          "status": "success",
          "url": "https://github.com/omry/arbiter/actions/runs/41111818916/job/124255476720"
        },
        {
          "conclusion": "SUCCESS",
          "name": "Python 3.10",
          "run_id": 124255477012,
          "run_status": "completed",
          "status": "success",
          "url": "https://github.com/omry/arbiter/actions/runs/41111818916/job/124255477012"
        },
        {
          "conclusion": "SUCCESS",
          "name": "Python 3.11",
          "run_id": 124255476538,
          "run_status": "completed",
          "status": "success",
          "url": "https://github.com/omry/arbiter/actions/runs/41111818916/job/124255476538"
        },
        {
          "conclusion": "SUCCESS",
          "name": "Python 3.12",
          "run_id": 124255476732,
          "run_status": "completed",
          "status": "success",
          "url": "https://github.com/omry/arbiter/actions/runs/41111818916/job/124255476732"
        },
        {
          "conclusion": "SUCCESS",
          "name": "Python 3.14",
          "run_id": 124255476700,
          "run_status": "completed",
          "status": "success",
          "url": "https://github.com/omry/arbiter/actions/runs/41111818916/job/124255476700"
        },
        {
          "conclusion": "SUCCESS",
          "name": "Python lint",
          "run_id": 124255475843,
          "run_status": "completed",
          "status": "success",
          "url": "https://github.com/omry/arbiter/actions/runs/41111818916/job/124255475843"
        },
        {
          "conclusion": "SUCCESS",
          "name": "Website",
          "run_id": 124255476357,
          "run_status": "completed",
          "status": "success",
          "url": "https://github.com/omry/arbiter/actions/runs/41111818916/job/124255476357"
        }
      ],
      "head_sha": "e144661ff7049451365f0dccc80ba840f39d3433",
      "id": "sha256:690d3ea59271748278866c108cab2b1c6a90b54dc69741dc342de046c4d10bc6",
      "required_checks": [
        "Gitar",
        "Platform Linux arm64",
        "Platform Linux x64",
        "Platform Windows arm64",
        "Platform Windows x64",
        "Platform macOS arm64",
        "Platform macOS x64",
        "Python 3.10",
        "Python 3.11",
        "Python 3.12",
        "Python 3.14",
        "Python lint",
        "Website"
      ],
      "status": "success"
    }
  ],
  "delivery_deferral_ledger_digest": "sha256:4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945",
  "delivery_deferrals": [],
  "findings": [],
  "pr": {
    "base_ref": "pr77",
    "base_sha": "42decb66262591759a645ee8c1a9be799aaac03c",
    "body_digest": "sha256:1f861000eb0549d1a0e2b6464dbba4208647d851084b570591640a5edcec2e4a",
    "body_identity_version": 2,
    "diff_digest": "sha256:eb6aa2c014192d3e22d558cbf35c610a0e53c1befb62fda3ac90f88e35e68300",
    "head_ref": "pr79",
    "head_sha": "e144661ff7049451365f0dccc80ba840f39d3433",
    "pr": 79,
    "repository": "omry/arbiter",
    "scope_authority": [
      {
        "digest": "sha256:b6511414b3a9b485542df83c8f7abfc499dc8d06e522819b48e162a562d21c57",
        "path": "docs/authentication/high-level-design.md"
      },
      {
        "digest": "sha256:38456f43776f8b47b1c5beb7cdbf5be5a34832267286a0135a489083980a4379",
        "path": "docs/authentication/implementation-plan.md"
      },
      {
        "digest": "sha256:7cbad8803d0ade4090289d22a681a01026782ade9785c731ac7a2d8a33b9c0e1",
        "path": "docs/authentication/portable-enrollment-lld.md"
      },
      {
        "digest": "sha256:d56e92a7cb01f131ba499650c4a5d7b2c8d17adf2cdc7d612eee7c5f53d07929",
        "path": "docs/authentication/requirements.md"
      }
    ],
    "title_digest": "sha256:d207a6c78aa3c37f5a588110d09989a2ca6b5da95034733c61a4adc6c6e960ba"
  },
  "record_version": 6,
  "review_observations": [],
  "review_requests": [
    {
      "base_established_at": "2026-10-30T17:35:04Z",
      "base_ref": "pr77",
      "base_sha": "42decb66262591759a645ee8c1a9be799aaac03c",
      "body_digest": "sha256:52b12666d46ee99e5a6ad08709fe7b363d4f6183ad41afc2a8adbd901f478d3c",
      "created_at": "2026-10-30T17:48:00Z",
      "head_sha": "893b4302769ce445823cdcdc214b9763ba92cba4",
      "id": 6529576924,
      "kind": "regular-review"
    },
    {
      "base_established_at": "2026-10-30T17:35:04Z",
      "base_ref": "pr77",
      "base_sha": "42decb66262591759a645ee8c1a9be799aaac03c",
      "body_digest": "sha256:6ef1821efbf57bc1bf8ef3c38b099243447d5512b61ce23909bd0d40a7996868",
      "created_at": "2026-10-30T19:14:55Z",
      "head_sha": "e144661ff7049451365f0dccc80ba840f39d3433",
      "id": 6531477412,
      "kind": "regular-review"
    }
  ],
  "review_results": [
    {
      "base_ref": "pr77",
      "base_sha": "42decb66262591759a645ee8c1a9be799aaac03c",
      "body_digest": "sha256:3b2060c31374e2b628610e38ce1fc44ef01ecae380403a890a3fa69882e18067",
      "commit_id": "893b4302769ce445823cdcdc214b9763ba92cba4",
      "id": 6529610397,
      "inline_message_ids": [],
      "request_comment_id": 6529576924,
      "result_kind": "clean",
      "status": "result",
      "submitted_at": "2026-10-30T17:49:17Z",
      "unresolved_thread_ids": []
    },
    {
      "base_ref": "pr77",
      "base_sha": "42decb66262591759a645ee8c1a9be799aaac03c",
      "body_digest": "sha256:c5f03ba63b600572b02226bdfd5da7f6363a3a96906de4961e8df9cbef944f5e",
      "commit_id": "e144661ff7049451365f0dccc80ba840f39d3433",
      "id": 6531503844,
      "inline_message_ids": [],
      "request_comment_id": 6531477412,
      "result_kind": "clean",
      "status": "result",
      "submitted_at": "2026-10-30T19:16:15Z",
      "unresolved_thread_ids": []
    }
  ],
  "revision_fingerprint": "sha256:6c049421d076d6e2bdb10660bb0a12b44ea52604aa165617ac76f16826fac35b",
  "rounds": [
    {
      "applied_fix_paths": [
        "server/tests/integration/test_enrollment_cli_peer.py"
      ],
      "disposition_changes": [],
      "effective_diff_digest": "sha256:eb6aa2c014192d3e22d558cbf35c610a0e53c1befb62fda3ac90f88e35e68300",
      "finding_ids": [],
      "invariants": [
        "Original2.10.3scope/authority/1000authoredcap retained",
        "Current local R1-1WindowsfixtureACL repaired by existing conditional777Windows/700POSIXtestline; allproductionvalidatorsunchanged",
        "CorrectedWIPgeneral/actualDBB/freshhistoryawareSolclean and completecurrent6localchecks pass",
        "Originalremoteexact893b43clean; oldCI failures retained; newe144661requirescurrentexactreviewandCI"
      ],
      "outcome": "corrected-head-needs-review",
      "proposed_fix_paths": [
        "server/tests/integration/test_enrollment_cli_peer.py"
      ],
      "resulting_head": "e144661ff7049451365f0dccc80ba840f39d3433",
      "review_observation_id": null,
      "review_request_id": 6529576924,
      "review_result_id": 6529610397,
      "reviewed_head": "893b4302769ce445823cdcdc214b9763ba92cba4",
      "root_cause": "Separate actual combined local current-trail R1-1, not a GitHub finding: nested test mkdir0700 recreated WindowsOwnerRightsACE after private parentfixture. One existingconditionalmkdir mode repair retainsPOSIX700andallproductionvalidators. BothoriginalWindowsCIarchitecturefailures, nativeWindowsACLpositiveprobe and fullcurrentlocal6checks retained; finalcontextgeneral/actualDBB/freshSolclean. HistoricalWIP expiryR1-1 separatetrail staysverified. Python3.10unchangedHTTPtimeout remains unproved oldCIobservation, no timeoutpatch/rerun/waiver. Canonicaltypedv3amendment and exactsafe-predecessorsync publishede144661 with originalmetadata/mappingpreserved. Wrongoriginalno-opselection explicitlyretained; exactpinnedsyncarm recovered in run_5qyxsf2ttw2jpw9y78cbxa6rxs withsameplan/operation/guards. Detailedoriginalfinding/response/footprint /home/omry/dev/arbiter/temp/authentication-portable-2.10/auth2103-pr79-reviewed-correction-assessment.json; actualfullreview /home/omry/dev/arbiter/temp/authentication-portable-2.10/auth2103-pr79-full-review-result.json",
      "round": 1,
      "unresolved_current_slice_findings": 0,
      "unresolved_design_blockers": 0
    },
    {
      "applied_fix_paths": [],
      "disposition_changes": [],
      "effective_diff_digest": "sha256:eb6aa2c014192d3e22d558cbf35c610a0e53c1befb62fda3ac90f88e35e68300",
      "finding_ids": [],
      "invariants": [
        "Exact current complete native owner e144/base42de and unchanged approved scope",
        "Portable selectedidentity/independentissuerrevision/uniqueactivation/receipt invariants conform to original2.10.3; publicv2cutover remains2.10.4",
        "Actualsixcurrentlocalchecks andall13requirednativeCIpassed includingWindowsx64/arm64 andPython3.10",
        "Currentprimarygeneral,actualfreshDBB,freshhistory-awareSolclean0; strictcurrentPR-localproofverified"
      ],
      "outcome": "clean",
      "proposed_fix_paths": [],
      "resulting_head": "e144661ff7049451365f0dccc80ba840f39d3433",
      "review_observation_id": null,
      "review_request_id": 6531477412,
      "review_result_id": 6531503844,
      "reviewed_head": "e144661ff7049451365f0dccc80ba840f39d3433",
      "root_cause": "No new current-slice defect or correction. Historical expiry-under-accounts and WindowsOwnerRightsfixture findings remain truth-fixed with original findings/evidence retained. Current nativeWindowsx64/arm64CI verifies corrected journeys. Allcurrentgatesclean; originalold22spent/cumulativecaps preserved.",
      "round": 2,
      "unresolved_current_slice_findings": 0,
      "unresolved_design_blockers": 0
    }
  ],
  "schema": "awd:swe:pr-cycle-state",
  "version": 2
}

chatgpt-codex-connector · 2026-10-30T17:43:36Z

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-30T19:16:16.580968Z	`e144661`	Manual request
🔒 Security Review	⚠️ Failed 2026-10-30T17:43:33.755674Z We couldn’t complete this review. Comment `@codex security review` to try again.	`893b430`	Draft marked ready

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

chatgpt-codex-connector · 2026-10-30T17:43:38Z

The account paying for this security review has reached its Codex usage limits. The payer can check the Codex usage dashboard. For personal accounts, using credits requires enabling “Use credits for security reviews” in Code review settings. If you do not manage the paying account, contact this repository's admins.

omry · 2026-10-30T17:48:00Z

@codex review

Exact head: 893b430

chatgpt-codex-connector · 2026-10-30T17:49:17Z

Codex Review: Didn't find any major issues. Breezy!

Reviewed commit: 893b430276

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

Preserve a selected portable agent identity through target preparation and activation. The target binds approval to the exact registered issuer revision, issues its own access credentials, and commits the result and unique agent binding in one transaction. A denied or inactive target binding blocks another enrollment. Validate the selected identity before the client sends ready, and recover the exact committed target result after a lost reply or restart. Recheck portable certificate validity after account evaluation, before authorizing a new commit. Public registration and CLI source selection remain on the fresh flow until the next planned slice. Validation: 1,853 Python tests passed (43 skipped), 20 portable-focused tests passed, explicit full formatting and lint/type checks passed, and Go tests/vet passed. Real Python/Go peers cover A offline, B restart, lost replies and changed-certificate rejection. The expiry regression fails against the original activation code and passes with this fix. Native CI and remote review are separate publication gates.

gitar-bot · 2026-10-30T19:02:43Z

Code Review ✅ Approved

🔴 High risk · Adds portable-identity approval and target credential issuance; a validation or binding error could enroll an unintended agent and grant it access.

Preserves a selected portable agent identity through target preparation and activation, binding approval to the exact registered issuer revision and committing the result and unique agent binding in one transaction. No issues found.

Verification

Rules No rules evaluated

Functional validation Not enabled

Set up

_{For more verification details, comment gitar display:verbose.}

Options

Auto-apply is off → Gitar will not commit updates to this branch.
Display: compact → Showing compact verification results.

Comment with these commands to change the behavior for this request:

`Auto-apply`	`Compact`
`gitar auto-apply:on`	`gitar display:verbose`

_{Was this helpful? React with 👍 / 👎 | Powered by Gitar — free for open source}

omry · 2026-10-30T19:14:55Z

@codex review

Exact head: e144661

chatgpt-codex-connector · 2026-10-30T19:16:15Z

Codex Review: Didn't find any major issues. Swish!

Reviewed commit: e144661ff7

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

omry changed the base branch from main to pr77 October 30, 2026 17:35

omry added this pull request to stack #77 October 30, 2026 17:35

omry marked this pull request as ready for review October 30, 2026 17:43

omry force-pushed the pr79 branch from 893b430 to e144661 Compare October 30, 2026 19:01

omry added the approved PR passed review and required checks label Oct 30, 2026

Navigation Menu

Repository navigation

[arbiter-authentication/2.10.3] Prepared reuse and single activation - #79

[arbiter-authentication/2.10.3] Prepared reuse and single activation#79
omry wants to merge 1 commit into
pr77from
pr79

omry commented Oct 30, 2026 •

edited

Loading

Uh oh!

omry commented Oct 30, 2026 •

edited

Loading

Uh oh!

chatgpt-codex-connector Bot commented Oct 30, 2026 •

edited

Loading

Uh oh!

chatgpt-codex-connector Bot commented Oct 30, 2026

Uh oh!

omry commented Oct 30, 2026

Uh oh!

chatgpt-codex-connector Bot commented Oct 30, 2026

Uh oh!

gitar-bot Bot commented Oct 30, 2026

Uh oh!

omry commented Oct 30, 2026

Uh oh!

chatgpt-codex-connector Bot commented Oct 30, 2026

Uh oh!

This branch has not been deployed

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

omry commented Oct 30, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

omry commented Oct 30, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

chatgpt-codex-connector Bot commented Oct 30, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codex Review Summary

Uh oh!

chatgpt-codex-connector Bot commented Oct 30, 2026

Uh oh!

omry commented Oct 30, 2026

Uh oh!

chatgpt-codex-connector Bot commented Oct 30, 2026

Uh oh!

gitar-bot Bot commented Oct 30, 2026

Uh oh!

omry commented Oct 30, 2026

Uh oh!

chatgpt-codex-connector Bot commented Oct 30, 2026

Uh oh!

This branch has not been deployed

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

omry commented Oct 30, 2026 •

edited

Loading

omry commented Oct 30, 2026 •

edited

Loading

chatgpt-codex-connector Bot commented Oct 30, 2026 •

edited

Loading