[Cuarroc]

Das Ausschalten des globalen Not-Aus ist jetzt vor Agenten geschützt.
Einschalten bleibt mit dem normalen API-Zugriff möglich.
Zum Ausschalten ist nun der bestehende Verdict-Nachweis erforderlich.

Report

What changed

• POST /api/emergency-stop still accepts active: true with the ordinary API token, preserving fail-safe activation.
• active: false now requires the existing verdict token and returns 403 with a decision-specific message when proof is missing or wrong.
• pa estop off accepts --verdict-token and uses the established safe verdict-token resolution path; status and activation remain ordinary requests.
• Accepted emergency-stop transitions retain the existing atomic store audit. Rejected authorization attempts are not persisted because the current API backend exposes no rejection-audit operation; no new rights or audit engine was introduced.
• Final package size: 147 changed lines across src-tauri/src/api.rs and src-tauri/src/bin/pa.rs.

Evidence

• CARGO_BUILD_JOBS=1 cargo test --manifest-path src-tauri/Cargo.toml emergency_stop_release_requires_verdict_authority — Exit 101 before the fix: release returned 200 instead of the expected 403.
• CARGO_BUILD_JOBS=1 cargo test --manifest-path src-tauri/Cargo.toml emergency_stop — Exit 0; 9 emergency-stop tests passed.
• CARGO_BUILD_JOBS=1 cargo test --manifest-path src-tauri/Cargo.toml --bin pa listing_and_the_board_filter_by_project — Exit 0.
• bash scripts/ci/red-first.sh — Exit 0; test absent/red at merge base and green at candidate head.
• CARGO_BUILD_JOBS=1 bash scripts/ci/gates.sh lane prepush — Exit 0; final run: 392 frontend tests, 502 HQ tests, and 1,659 Rust tests passed.
• Push verification: git ls-remote origin refs/heads/codex/w5-04e-estop-release-auth matched candidate 4f97643a9ca8d41eca85ee7b030b8b3a12011666 — Exit 0.

NICHT ABGEDECKT

• Linux does not compile the #[cfg(windows)] tests (run_in_pty, npm shim, ConPTY, DPAPI) or the Windows clippy arms (KNOWN_ISSUES KI-7).
• The Windows lane runs in the Mergify merge queue.
• External updater, OmniRoute, and mirror services are outside the prepush lane.
• Rejected emergency-stop release attempts are not durably audited because the existing backend has no rejection-audit interface.

Review

Review disposition

Tier A, candidate 4f97643a9ca8d41eca85ee7b030b8b3a12011666, two reviewers outside the author family (codex).

• Reviewer 1: claude (Sonnet 5.5). Checked gate vs. route body parsing (verdict_decision uses the same serde_json parse as parse_body; empty or invalid bodies fall through to the route's 400, so no bypass), path normalisation (segments() is shared), other release paths (no UI command, script or doc calls active:false) and the CLI parse arms. No findings.
• Reviewer 2: glm-5.2 (Ollama Cloud).
  • F1, low, src-tauri/src/bin/pa.rs:1898: estop on --verdict-token x reports "estop takes on, off or status, got on" because the [other, ..] arm shadows the _ arm. Confirmed true. Disposition: rejected for this package - the message is misleading, but the command still fails closed (error, no request sent) and there is no security effect. Follow-up: reorder the arms.

No high or medium finding; no code change after review, so no second round. CI at the candidate: gates (linux), gates (windows), red-first green.

Open points

• None blocking this draft.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 4f97643a9c

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Preserve the red-first proof in commit history

This commit combines the regression test with its fix and contains no Test-First:, Regression-For:, or No-Test: trailer. Running BASE_SHA=074299f^ HEAD_SHA=074299f bash scripts/ci/red-first.sh --plan exits 1 because both changed source files lack the required evidence, so the mandatory red-first check will block this candidate; retain the compiling, failing test as the preceding commit and carry Test-First: src-tauri/src/api.rs::emergency_stop_release_requires_verdict_authority on the fix.

AGENTS.md reference: AGENTS.md:L16-L18

Useful? React with 👍 / 👎.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-03T02:22:19.949086Z	4f97643	Draft marked ready

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[mergify]

Queued — the merge queue status continues in this comment ↓.

[Cuarroc]

@Mergifyio queue

[mergify]

Merge Queue Status

• ✅ Entered queue — 2026-10-03 02:41 UTC · Rule: default · triggered by @Cuarroc with the @mergifyio queue command
• ✅ Checks passed · on draft merge queue: checking #175 + #166 + #165 + #158 together on main (608780a) #180
• ✅ Merged — 2026-10-03 03:28 UTC · at 5cd1f21ffae588d3f1b6c4c1a14db5eb4b92e2c1 · merge

This pull request spent 47 minutes 16 seconds in the queue, including 13 minutes 26 seconds running CI.

Required conditions to merge

• check-success = gates (linux)
• check-success = gates (windows)
• check-success = red-first
• label != do-not-merge
  • fix(api): require verdict authority to release emergency stop #158
  • docs(plan): record architecture inbox decisions #165
  • ARCH-01a: honor PROJECTA_API_FILE in hq-live #166
  • Fix script-modes self-test under Git for Windows #175