Skip to content

[Promote] security: persisted-state RCE/CSP hardening + register body cap (spec 09 §B/§C/§D) (#99) - #297

Merged
lopugit merged 5 commits into
mainfrom
promote/pr-99-eval-csp-hardening--to-main
Aug 20, 2026
Merged

[Promote] security: persisted-state RCE/CSP hardening + register body cap (spec 09 §B/§C/§D) (#99)#297
lopugit merged 5 commits into
mainfrom
promote/pr-99-eval-csp-hardening--to-main

Conversation

@lopugit

@lopugit lopugit commented Aug 18, 2026

Copy link
Copy Markdown
Owner

Automated promotion of #99 from develop to main, opened by the Promote features to main workflow for release review.

Source
Source PR #99 — security: persisted-state RCE/CSP hardening + register body cap (spec 09 §B/§C/§D)
Author @lopugit
Merged into develop 2026-08-18T03:07:09Z
Merge commit 88cfa2287f50799e064e20d02f6ad84fca50a230
Head branch claude/eval-csp-hardening

How to review

  • This PR re-applies the source PR's exact changes onto main
    (git cherry-pick -x; each commit message references the original SHA).
  • Merge it normally to release the change to main —
    the Sync main into develop workflow keeps develop aligned afterwards.
  • Close it (without merging) to keep the change out of main;
    the workflow never recreates a closed promotion (reopen it to change your mind).
  • Prefer shipping everything at once? Merge the standing omnibus
    Promote develop to main PR instead — this PR's diff then becomes
    empty and the workflow closes it automatically.

Automatic conflict-resolution review

  • The exact source patch conflicted with main, so the trusted AI
    promotion resolver produced this branch automatically instead of leaving manual commands.
  • Its write scope was limited to non-Graphify paths already changed by the source PR;
    Graphify output was handled as derived data, and unresolved conflict markers were rejected.
  • A github-actions[bot] comment on source PR security: persisted-state RCE/CSP hardening + register body cap (spec 09 §B/§C/§D) #99 attests the exact
    base, source endpoints, reservation commit, final head, plan hash, and resolver run.
  • Please review the resolved diff before merging; no manual branch repair is required.

🤖 Generated by the promote-features-to-main workflow.

@github-actions
chore(ci): reserve AI promotion resolution for #99 [skip ci]
844508c 
Thingtime-Promotion-Reservation: v1
Thingtime-Promotion-Source-PR: 99
Thingtime-Promotion-Base-Ref: main
Thingtime-Promotion-Base-SHA: fd970e9
Thingtime-Promotion-Branch: promote/pr-99-eval-csp-hardening--to-main
Thingtime-Promotion-Source-Start-SHA: 6a026ec
Thingtime-Promotion-Source-End-SHA: 88cfa22
Thingtime-Promotion-Source-Lineage: verified
Thingtime-Promotion-Plan-Hash: a87618d80b7ee0ee190803923c774580dbec74c6d44cfb1e818b0c964b17bdde
@github-actions
Promote source PR #99 onto main
58e261d 
Thingtime-Promotion-Source-PR: 99

Thingtime-Promotion-Base-Ref: main

Thingtime-Promotion-Base-SHA: fd970e9

Thingtime-Promotion-Branch: promote/pr-99-eval-csp-hardening--to-main

Thingtime-Promotion-Source-Tip-SHA: 88cfa22

Thingtime-Promotion-Source-Start-SHA: 6a026ec

Thingtime-Promotion-Source-End-SHA: 88cfa22

Thingtime-Promotion-Source-Lineage: verified

Thingtime-Promotion-Plan-Hash: a87618d80b7ee0ee190803923c774580dbec74c6d44cfb1e818b0c964b17bdde

Thingtime-Promotion-Patch-ID: 779ee18193bd56c13d95abd455b32e8f3609932d

Resolved by the promotion worker: https://github.com/lopugit/thingtime/actions/runs/32094562478
@github-actions
chore: refresh graphify outputs after promotion resolution
b134f74 
graphify extract with semantic claude-cli backend; unchanged content reused the tracked cache

Thingtime-Promotion-Plan-Hash: a87618d80b7ee0ee190803923c774580dbec74c6d44cfb1e818b0c964b17bdde

Refreshed by the promotion conflict worker: https://github.com/lopugit/thingtime/actions/runs/32094562478
@github-actions github-actions Bot added promotion Automated develop → main promotion PR ai-conflict-resolved Promotion conflict resolved by the isolated AI worker review-ai-resolution Review the AI-resolved promotion conflict paths labels Aug 18, 2026
@vercel

vercel Bot commented Aug 18, 2026 •
edited
Loading

Copy link
Copy Markdown

The latest updates on your projects. Learn more about Vercel for GitHub.

Project Deployment Actions Updated (UTC)
thingtime Ready Ready Preview Aug 20, 2026 3:22pm

Request Review

@github-actions

github-actions Bot commented Aug 18, 2026

Copy link
Copy Markdown
Contributor

🤖 Automatic promotion conflict resolution completed.

Source PR: #99 · plan: a87618d80b7ee0ee190803923c774580dbec74c6d44cfb1e818b0c964b17bdde · workflow run

Base: main at fd970e9ab4bb729e2117f92e9afc8e9782154a61

Reservation: 844508c6b371d24d01520a69f57485470534df01 · verified head: b134f744b019c2898d7a77f4f7bcd64c927de800

Please manually review the paths the isolated AI resolved:

  • remix/CHANGELOG.md

Model waterfall: --model claude-opus-5 --fallback-model claude-fable-5,default · Graphify refresh: true (semantic: claude-cli).

@github-actions github-actions Bot mentioned this pull request Aug 18, 2026
Merged
github-advanced-security[bot]
github-advanced-security Bot found potential problems Aug 18, 2026
View reviewed changes
Comment thread remix/scripts/verify-vercel-output.mjs Fixed
Comment thread remix/scripts/verify-vercel-output.mjs Fixed
@github-actions

github-actions Bot commented Aug 18, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

⚠️ The resolver stopped in a later safety, verification, or publication step. No residual conflicted paths were confirmed; see the workflow run.

@github-actions

github-actions Bot commented Aug 18, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

🤝 Merged main into promote/pr-99-eval-csp-hardening--to-main — conflicts auto-resolved by the resolve-pr-conflicts workflow.

Conflicted files:

  • remix/CHANGELOG.md

Please review the merge commit before relying on it.

@github-actions @claude
Merge main into promote/pr-99-eval-csp-hardening--to-main (AI-resolve…
94f29b7 
…d conflicts)

Conflicted paths: remix/CHANGELOG.md

Resolved by the resolve-pr-conflicts workflow: https://github.com/lopugit/thingtime/actions/runs/32099836171

Co-Authored-By: Claude <noreply@anthropic.com>
lopugit added a commit that referenced this pull request Aug 18, 2026
@lopugit
all: merge PR #297 — [Promote] security: persisted-state RCE/CSP hard…
1b88662 
…ening + register body cap (spec 09 §B/§C/§D) (#99)

# Conflicts:
#	graphify-out/cache/semantic/15c43eb49a993919df2cf7be8d39646ca84fade8ba44268003a2cb9f1a824c40.json
#	graphify-out/cache/semantic/a0f10b45212c2643c917726af62add4389f99df5abdfa36a7782077bd1fa562c.json
#	graphify-out/cache/semantic/e22056684b94654f2037143b00a0e5fb21cb25a236fbc9f051f81bcdefdd1c98.json
lopugit added a commit that referenced this pull request Aug 18, 2026
@lopugit
all: merge PR #297 — [Promote] security: persisted-state RCE/CSP hard…
456db2e 
…ening + register body cap (spec 09 §B/§C/§D) (#99)

# Conflicts:
#	graphify-out/cache/semantic/15c43eb49a993919df2cf7be8d39646ca84fade8ba44268003a2cb9f1a824c40.json
#	graphify-out/cache/semantic/a0f10b45212c2643c917726af62add4389f99df5abdfa36a7782077bd1fa562c.json
#	graphify-out/cache/semantic/e22056684b94654f2037143b00a0e5fb21cb25a236fbc9f051f81bcdefdd1c98.json
github-actions Bot added a commit that referenced this pull request Aug 18, 2026
@github-actions
all: merge PR #297 — [Promote] security: persisted-state RCE/CSP hard…
439e365 
…ening + register body cap (spec 09 §B/§C/§D) (#99)

# Conflicts:
#	graphify-out/cache/semantic/15c43eb49a993919df2cf7be8d39646ca84fade8ba44268003a2cb9f1a824c40.json
#	graphify-out/cache/semantic/a0f10b45212c2643c917726af62add4389f99df5abdfa36a7782077bd1fa562c.json
#	graphify-out/cache/semantic/e22056684b94654f2037143b00a0e5fb21cb25a236fbc9f051f81bcdefdd1c98.json
github-actions Bot added a commit that referenced this pull request Aug 19, 2026
@github-actions
all: merge PR #297 — [Promote] security: persisted-state RCE/CSP hard…
555da14 
…ening + register body cap (spec 09 §B/§C/§D) (#99)

# Conflicts:
#	graphify-out/cache/semantic/15c43eb49a993919df2cf7be8d39646ca84fade8ba44268003a2cb9f1a824c40.json
#	graphify-out/cache/semantic/a0f10b45212c2643c917726af62add4389f99df5abdfa36a7782077bd1fa562c.json
#	graphify-out/cache/semantic/e22056684b94654f2037143b00a0e5fb21cb25a236fbc9f051f81bcdefdd1c98.json
lopugit added a commit that referenced this pull request Aug 20, 2026
@lopugit
Reconcile promotion #297 with current main
662f726
github-advanced-security[bot]
github-advanced-security Bot found potential problems Aug 20, 2026
View reviewed changes
Comment thread remix/scripts/verify-vercel-output.mjs Fixed
Comment thread remix/scripts/verify-vercel-output.mjs Fixed
Comment thread remix/scripts/verify-vercel-output.mjs Fixed
@lopugit
lopugit force-pushed the promote/pr-99-eval-csp-hardening--to-main branch from 662f726 to 22cf5d9 Compare August 20, 2026 15:19
@lopugit
lopugit merged commit b046e8e into main Aug 20, 2026
27 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

1 more reviewer
@github-advanced-security github-advanced-security[bot] github-advanced-security[bot] left review comments
Reviewers whose approvals may not affect merge requirements

Assignees

No one assigned

Labels

ai-conflict-resolved Promotion conflict resolved by the isolated AI worker promotion Automated develop → main promotion PR review-ai-resolution Review the AI-resolved promotion conflict paths

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@lopugit @github-advanced-security