Automated Sync from main to stable

.agents/skills/launch-openshell-gator/SKILL.md

@@ -282,6 +282,10 @@ The launcher streams image-build and provisioning output to the terminal. Import
 - `/sandbox/.openshell-agent/history.jsonl` contains the latest 100 supervisor transitions, including active-cycle starts and completed cycle results.
 - `openshell-agent: still running watch cycle ...` is a heartbeat during long active model cycles.
 - `review_feedback_lookup_failed` means Gator could not build the required cross-SHA feedback ledger and deliberately skipped a context-free review.
+- Large PRs use local Git trees for patch identity instead of GitHub's
+  size-limited full-diff endpoint. An unavailable patch ID alone does not block
+  the ledger; it disables rebase-equivalence shortcuts. Reviewers should inspect
+  oversized changes file-by-file locally.
 
 ### Inspect Active Sandboxes
 

.agents/skills/watch-github-actions/SKILL.md

@@ -125,6 +125,22 @@ gh run list --json databaseId,status,headBranch,url --jq '.[] | {id: .databaseId
 
 ## View Job Logs
 
+For `Codex Security`, an exit code of 2 with partial coverage is an incomplete
+scan, not a HIGH/CRITICAL threshold failure. Check the execution diagnostics in
+the job summary and the `codex-security-diagnostics-<run>-<attempt>` artifact on
+scan failure. It contains fixed status values, aggregate coverage counts, and
+disk space before, after, and the minimum sampled every five seconds. Missing
+coverage or manifest documents indicate no readable final report was available;
+deferred items or surfaces needing follow-up can explain partial coverage.
+Sampling cannot rule out a disk spike between samples.
+
+Artifacts and logs in this public repository are public. Never upload the raw
+scan directory, `report.md`, `coverage.json`, findings, agent state, or scanner
+logs. Coverage reasons and notes are free text and may disclose vulnerabilities.
+The public diagnostic intentionally omits them; detailed review needs an
+approved private destination. Helpers must come from the workflow revision,
+not from the candidate under scan.
+
 `setup-nix` retries development-shell preparation once when `prepare-shell`
 is enabled. Inspect both attempts in the job log; `setup-rust` assumes the
 shell has already been prepared. Cargo, lint, and test commands are not retried.

.github/workflows/codex-security.yml

@@ -145,12 +145,13 @@ jobs:
           sparse-checkout: tasks/scripts
           persist-credentials: false
 
-      - name: Stage the range resolver
+      - name: Stage trusted scan helpers
         run: |
           set -euo pipefail
           install -d -m 700 "$RUNNER_TEMP/range-resolver"
           cp workflow-revision/tasks/scripts/release.py \
             workflow-revision/tasks/scripts/codex_security_range.py \
+            workflow-revision/tasks/scripts/codex_security_diagnostics.py \
             "$RUNNER_TEMP/range-resolver/"
           rm -rf workflow-revision
 
@@ -185,6 +186,7 @@ jobs:
           python3 "$RUNNER_TEMP/range-resolver/codex_security_range.py" "${args[@]}"
 
       - name: Scan changes since the previous stable
+        id: scan
         env:
           BASE_SHA: ${{ steps.range.outputs.base_sha }}
           CODEX_SECURITY_BIN: ${{ runner.temp }}/codex-security/node_modules/.bin/codex-security
@@ -206,7 +208,10 @@ jobs:
             exit 2
           fi
 
-          "$CODEX_SECURITY_BIN" scan . \
+          python3 "$RUNNER_TEMP/range-resolver/codex_security_diagnostics.py" \
+            --scan-dir "$SCAN_DIR" \
+            --output "$RUNNER_TEMP/codex-security-diagnostics.json" \
+            -- "$CODEX_SECURITY_BIN" scan . \
             "${target_args[@]}" \
             --auth api-key \
             --model "$NVIDIA_INFERENCE_MODEL" \
@@ -220,7 +225,18 @@ jobs:
             --codex "features.multi_agent_v2.max_concurrent_threads_per_session=$CODEX_SECURITY_MAX_CONCURRENT_THREADS" \
             --codex 'approval_policy="never"' \
             --output-dir "$SCAN_DIR" \
-            --headless > /dev/null
+            --headless
+
+      # Actions artifacts in this public repository are publicly downloadable.
+      # Publish only the helper's allowlisted projection, never SCAN_DIR or state.
+      - name: Upload public execution diagnostics on failure
+        if: ${{ failure() && steps.scan.outcome == 'failure' }}
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: codex-security-diagnostics-${{ github.run_id }}-${{ github.run_attempt }}
+          path: ${{ runner.temp }}/codex-security-diagnostics.json
+          if-no-files-found: warn
+          retention-days: 7
 
       - name: Export SARIF
         env:

.tekton/odh-openshell-cli-push.yaml

@@ -39,8 +39,8 @@ spec:
     value: |
       [
         {"type": "cargo", "path": "."},
-        {"type": "rpm", "path": "deploy/konflux/cli"},
-        {"type": "generic", "path": "deploy/konflux/cli", "lockfile": "generic-fetcher.yaml"}
+        {"type": "cargo", "path": "deploy/konflux/cargo-auditable"},
+        {"type": "rpm", "path": "deploy/konflux/cli"}
       ]
   pipelineRef:
     resolver: git

.tekton/odh-openshell-cli-tag.yaml

@@ -40,8 +40,8 @@ spec:
     value: |
       [
         {"type": "cargo", "path": "."},
-        {"type": "rpm", "path": "deploy/konflux/cli"},
-        {"type": "generic", "path": "deploy/konflux/cli", "lockfile": "generic-fetcher.yaml"}
+        {"type": "cargo", "path": "deploy/konflux/cargo-auditable"},
+        {"type": "rpm", "path": "deploy/konflux/cli"}
       ]
   - name: build-args
     value:

.tekton/odh-openshell-gateway-push.yaml

@@ -39,8 +39,8 @@ spec:
     value: |
       [
         {"type": "cargo", "path": "."},
-        {"type": "rpm", "path": "deploy/konflux/gateway"},
-        {"type": "generic", "path": "deploy/konflux/gateway", "lockfile": "generic-fetcher.yaml"}
+        {"type": "cargo", "path": "deploy/konflux/cargo-auditable"},
+        {"type": "rpm", "path": "deploy/konflux/gateway"}
       ]
   pipelineRef:
     resolver: git

.tekton/odh-openshell-gateway-tag.yaml

@@ -40,8 +40,8 @@ spec:
     value: |
       [
         {"type": "cargo", "path": "."},
-        {"type": "rpm", "path": "deploy/konflux/gateway"},
-        {"type": "generic", "path": "deploy/konflux/gateway", "lockfile": "generic-fetcher.yaml"}
+        {"type": "cargo", "path": "deploy/konflux/cargo-auditable"},
+        {"type": "rpm", "path": "deploy/konflux/gateway"}
       ]
   - name: build-args
     value:

.tekton/odh-openshell-sandbox-push.yaml

@@ -39,8 +39,8 @@ spec:
     value: |
       [
         {"type": "cargo", "path": "."},
-        {"type": "rpm", "path": "deploy/konflux/sandbox"},
-        {"type": "generic", "path": "deploy/konflux/sandbox", "lockfile": "generic-fetcher.yaml"}
+        {"type": "cargo", "path": "deploy/konflux/cargo-auditable"},
+        {"type": "rpm", "path": "deploy/konflux/sandbox"}
       ]
   pipelineRef:
     resolver: git

.tekton/odh-openshell-sandbox-tag.yaml

@@ -40,8 +40,8 @@ spec:
     value: |
       [
         {"type": "cargo", "path": "."},
-        {"type": "rpm", "path": "deploy/konflux/sandbox"},
-        {"type": "generic", "path": "deploy/konflux/sandbox", "lockfile": "generic-fetcher.yaml"}
+        {"type": "cargo", "path": "deploy/konflux/cargo-auditable"},
+        {"type": "rpm", "path": "deploy/konflux/sandbox"}
       ]
   - name: build-args
     value:

.tekton/odh-openshell-supervisor-push.yaml

@@ -39,8 +39,8 @@ spec:
     value: |
       [
         {"type": "cargo", "path": "."},
-        {"type": "rpm", "path": "deploy/konflux/supervisor"},
-        {"type": "generic", "path": "deploy/konflux/supervisor", "lockfile": "generic-fetcher.yaml"}
+        {"type": "cargo", "path": "deploy/konflux/cargo-auditable"},
+        {"type": "rpm", "path": "deploy/konflux/supervisor"}
       ]
   pipelineRef:
     resolver: git

.tekton/odh-openshell-supervisor-tag.yaml

@@ -40,8 +40,8 @@ spec:
     value: |
       [
         {"type": "cargo", "path": "."},
-        {"type": "rpm", "path": "deploy/konflux/supervisor"},
-        {"type": "generic", "path": "deploy/konflux/supervisor", "lockfile": "generic-fetcher.yaml"}
+        {"type": "cargo", "path": "deploy/konflux/cargo-auditable"},
+        {"type": "rpm", "path": "deploy/konflux/supervisor"}
       ]
   - name: build-args
     value:

Cargo.toml

@@ -85,6 +85,7 @@ socket2 = "0.6"
 # Serialization
 serde = { version = "1", features = ["derive"] }
 serde_json = "1"
+serde_path_to_error = "0.1"
 serde_yml = { package = "noyalib", version = "0.0.28", default-features = false, features = ["std", "compat-serde-yaml"] }
 toml = "0.8"
 apollo-parser = "0.8.5"

crates/openshell-cli/src/main.rs

@@ -1781,7 +1781,11 @@ enum SandboxCommands {
         #[arg(value_hint = ValueHint::AnyPath)]
         local_path: String,
 
-        /// Destination path in the sandbox (defaults to the container's working directory).
+        /// Destination path in the sandbox (defaults to its working directory).
+        ///
+        /// For an unfiltered single-file upload, an existing directory or a
+        /// trailing slash places the file inside that directory. A missing
+        /// nested path without a trailing slash renames the file.
         dest: Option<String>,
 
         /// Disable `.gitignore` filtering (uploads everything).

crates/openshell-cli/src/run.rs

@@ -1060,15 +1060,17 @@ pub async fn sandbox_create(
                         "\u{2022}".dimmed(),
                     );
                 }
-                sandbox_upload_planned(
+                // Boxed so the upload state machine lives on the heap instead of
+                // inflating the `sandbox_create` future (clippy::large_futures).
+                Box::pin(sandbox_upload_planned(
                     upload_plan,
                     &effective_server,
                     &sandbox_name,
                     Path::new(local_path),
                     dest,
                     &effective_tls,
                     workspace,
-                )
+                ))
                 .await
                 .wrap_err_with(|| {
                     format!(
@@ -5110,7 +5112,7 @@ async fn sandbox_upload_planned(
     sandbox_path: Option<&str>,
     tls: &TlsOptions,
     workspace: &str,
-) -> Result<()> {
+) -> Result<Option<String>> {
     match plan {
         SandboxUploadPlan::GitAware { base_dir, files } => {
             sandbox_sync_up_files(
@@ -5123,10 +5125,13 @@ async fn sandbox_upload_planned(
                 tls,
                 workspace,
             )
-            .await
+            .await?;
+            Ok(None)
         }
         SandboxUploadPlan::Regular => {
-            sandbox_sync_up(server, name, local_path, sandbox_path, tls, workspace).await
+            sandbox_sync_up(server, name, local_path, sandbox_path, tls, workspace)
+                .await
+                .map(Some)
         }
     }
 }
@@ -5152,7 +5157,7 @@ pub async fn sandbox_upload(
         dest_display
     );
 
-    sandbox_upload_planned(
+    let uploaded_path = sandbox_upload_planned(
         upload_plan,
         server,
         name,
@@ -5163,7 +5168,11 @@ pub async fn sandbox_upload(
     )
     .await?;
 
-    eprintln!("{} Upload complete", "✓".green().bold());
+    if let Some(path) = uploaded_path {
+        eprintln!("{} Upload complete: {path}", "✓".green().bold());
+    } else {
+        eprintln!("{} Upload complete", "✓".green().bold());
+    }
     Ok(())
 }