Repository navigation
Conversation
CI-022 needs exact caller/callee/action revisions without a second parser, a broad token or a new omission authority. Discovery was request-scoped and kept only the declared remote ref of a reusable call; step actions had no typed reference at all. The completed discovery outcome now carries a component passport outside the inventory digest: one reference per job-level `uses` (reusable_workflow) and step `uses` (action or docker_image) of the exact caller commit, with repository/path/ref/digest split from the admitted syntax, declared immutability, `declarationsComplete`, and a resolution of observed, unresolved (closed reason) or denied. A same-commit callee is observed at the caller commit with its source blob. A remote Git component is resolved under provisional owner decision (2026-10-11) D6, narrowed to the caller installation: only a same-account repository found in the caller installation inventory (at most ten pages) and authorized for the actor is read, with the existing installation credential and existing workflow discovery operations (tag before branch, full SHA directly, commit, and the workflow tree for the callee blob). At most eight targets, four concurrent reads, a ten-second deadline and one resolution per process bound provider cost; reads start after the snapshot completes, outside any database transaction. Annotated tags, other installations, registries and local actions stay unresolved. Only the operator read route composes a resolver; proposal review, attestation and activation callers perform no extra reads. Split coordinates that the parser admits but the component contract rejects (surrounding whitespace in a ref or path, a Docker tag outside tag syntax, a remote callee path failing the workflow-path contract) are invalid references and never read targets, so classification cannot fail an admitted discovery. Callee reads run in one task group, so a failed read or the deadline cancels and joins every sibling before the resolution admission is released. The route and the browser share one 2,097,152-byte decoded discovery response budget; when the complete response exceeds it, the passport is sent with `referencesOmitted: true` and no references, which the browser renders as an explicit omission, never as an empty list. The HTTP contract, generated OpenAPI/TS, strict browser re-admission and a Dependency passport table expose the passport. ROADMAP CI-022, the O2 plan, module/UI/how-to docs, REQ-CI-RUNTIME-019 and REQ-CI-UI-008 record the delivered source and what remains: retained resolutions, reverse consumers with incomplete-not-none, observed run usage (persistence, migration queue), inputs, and native, browser and live-provider qualification. No test, browser, database or provider witness was executed locally.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Context
CI-022 needs exact caller, callee and action revisions without a second parser, a broad token or new omission authority. Discovery kept only the declared remote ref; step actions had no typed reference.
What changed
usesand per stepuses.declarationsComplete, and a resolution: observed, unresolved (closed reason) or denied.invalid_referenceand are never read.referencesOmitted: trueand no references, and the UI shows the omission explicitly.Expected result
The operator sees every reusable workflow, action and Docker image with its caller. Authorized same-installation callees show an exact commit (and the callee blob for reusable workflows) with the read time. Everything else is explicitly denied or unresolved. Incomplete declarations, and references omitted for size, are never shown as a dependency-free list. A discovery the parser accepted never fails because of how its references are classified.
Non-claims:
Provisional decisions: D6 (2026-10-11), narrowed to the caller installation.
Independent review: gpt-6-astra (xhigh); findings addressed or rejected with reasons in the single commit. Provisional owner decisions (2026-10-11) are labelled in the changed documents.