Repository navigation
fix(denkraum): enforce full startup config and physical state boundary - #750
Conversation
Test-First: tools/denkraum/config.test.mjs::missing root agent id is a start error Test-First: tools/denkraum/config.test.mjs::rejects root agent ids that the store cannot use Test-First: tools/denkraum/config.test.mjs::STATE through a junction/symlink into the repository is rejected Test-First: tools/denkraum/config.test.mjs::physical STATE checks resolve repository aliases and fail closed on broken links Test-First: tools/denkraum/server-gate.test.mjs::the server entry refuses to start without token/webhook secret Test-First: tools/denkraum/server-gate.test.mjs::the server entry validates ports and explicit root overrides through the full config
Use native realpath for both sides of the state boundary and derive notification status from the webhook URL. Reject invalid endpoints with fixed diagnostics before server startup. Test-First: tools/denkraum/config.test.mjs::check reports notifications disabled without a webhook URL Test-First: tools/denkraum/server-gate.test.mjs::webhook preflight matches notifier URL rules and redacts invalid URLs at both entries No-Test: Windows-only 8.3 alias path; covered by Windows-only test config.test.mjs::STATE through Windows 8.3 repository aliases is rejected, skipped on Linux
Merge Protections🟢 All 2 merge protections satisfied — ready to merge. Show 2 satisfied protections🟢 Paket-PR bringt seinen Bericht mitPackage branches (w<N>-, df<N>, ki-<N>, hq2-, dr-, z<N>-) must carry their report in the PR body, in a section that starts with "## Report".
🟢 🚦 Auto-queueWhen all merge protections are satisfied and these conditions match, this pull request will be queued automatically.
|
Cuarroc
added
the
review-ok
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: b43e87c3a5
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| symlinkSync(repoRoot, alias, process.platform === "win32" ? "junction" : "dir"); | ||
| symlinkSync(join(fixtureRoot, "missing"), broken, process.platform === "win32" ? "junction" : "dir"); |
There was a problem hiding this comment.
On Windows environments where creating junctions requires unavailable privileges, either symlinkSync call throws EPERM and aborts the entire test file instead of reporting this case as unsupported. The new junction test above already catches and skips on EPERM; apply the same handling here so restricted Windows runners can complete the remaining configuration tests.
Useful? React with 👍 / 👎.
| const env = flag > 1 ? { ...process.env, DECISION_DESK_ROOT_AGENT_ID: process.argv[flag + 1] } : process.env; | ||
| const { config, errors } = loadStartConfig(env, { repoRoot: join(root, '..', '..') }); |
There was a problem hiding this comment.
When the server is launched through a symlink or Windows junction, Node canonicalizes import.meta.url while process.argv[1] retains the alias, so the surrounding entry-point comparison is false and this startup block never runs; the process exits successfully without validating configuration or listening. The config entry already resolves aliases through createRequire, and the server entry needs equivalent detection before executing this integrated startup path.
AGENTS.md reference: AGENTS.md:L40-L43
Useful? React with 👍 / 👎.
Merge Queue Status
This pull request spent 23 minutes 40 seconds in the queue, including 13 minutes 54 seconds running CI. Required conditions to merge
|
Die Startprüfung berücksichtigt jetzt Windows-Kurznamen bei der Prüfung des Datenpfads.
Sie meldet Benachrichtigungen ohne Webhook-Adresse als ausgeschaltet und weist ungültige Adressen ohne Preisgabe ihres Werts zurück.
Die Linux-Prüfungen sind grün; der Windows-Nachweis und die unabhängigen Reviews stehen noch aus.
Report
DR-15b startup integration, including fix1 for R750-A1 and R750-A2. Parent: Z1, startup without manual secret input. Job:
srv-pr750-fix1; operator: NACHBESSERN; owner: Codex implementation worker. Authority: the dispatched fix1 brief. Delivery: implemented, tested, pushed; review, acceptance and integration remain with the orchestrator.85ab28626a3fbccf0a262afc64fb57383222fb8b.35dd42620f68601cc2ffb33fc01edd0e2a0a3161, verified before changes.b43e87c3a5795c19fa3b6b766f847a6a88b36f6e, verified withgit ls-remote.git diff --numstat "$(git merge-base origin/main HEAD)" HEAD; four authorized files only. Fix1 changes three of those files (76 insertions + 9 deletions).Changes
realpathSync.native. Missing descendants continue walking; broken links and other resolution failures remain fail-closed. The new Windows test derives the actual 8.3 alias withcmd.exeand checks both long-root/short-STATE and short-root/long-STATE directions. It visibly skips on non-Windows hosts or when the fixture has no short alias.DECISION_DESK_WEBHOOK_URLdisables notifications with a fixed reason. Present URLs use the existing notifier rules: HTTPS, the AgentsRoom host, a valid trigger path, and no credentials, non-default port, query or fragment. Invalid URLs produce a startup error naming only the variable and a fixed reason.--checkreports enabled status against the webhook variable. The existing server startup already calls this preflight, so no additional server source change was necessary in fix1.Findings
Source: supplied Anthropic review of
35dd426and the fix1 disposition brief. This table records implementation disposition, not an independent approval of the new head.b43e87c3a5795c19fa3b6b766f847a6a88b36f6e; Windows execution remains pending.b43e87c3a5795c19fa3b6b766f847a6a88b36f6e; Linux red-to-green evidence below.Evidence (2026-10-08 UTC, Linux, Node v24.21.0)
npm run dev:start-checknode --test tools/denkraum/config.test.mjs tools/denkraum/server-gate.test.mjsbefore fixnpm run test:denkraumbash scripts/ci/secret-scan.shgit commitwith regular precommit hookbash scripts/ci/red-first.sh --planbash scripts/ci/red-first.shCARGO_BUILD_JOBS=2 bash scripts/ci/gates.sh lane prepushCARGO_BUILD_JOBS=2 git push -u origin cursor/dr-15b-start-integrationb43e87c, 102 seconds. Rust suite: 1,888 passed, seven skipped.git ls-remote origin cursor/dr-15b-start-integrationgit diff --checkThe red-first script normally runs
npm ciin its temporary base checkout. To honor the no-install instruction, a process-localnpmfunction handled only that exact invocation by comparing bothpackage.jsonandpackage-lock.jsonwith the existing worktree and symlinking its existingnode_modules; comparisons and linking had to succeed. Other npm commands were passed through. No gate or test implementation was changed or skipped, and no installation occurred.New commit trailers:
Architecture drift
Gate passed without allowlist changes. Existing startup and notifier contracts retained.
NICHT ABGEDECKT
STATE through Windows 8.3 repository aliases is rejectedwas skipped on Linux with reasonWindows-only 8.3 short-name resolution. No local Windows RED or GREEN is claimed. On Windows it also skips visibly when 8.3 aliases are disabled.scripts/ci/gates.sh:164registers the Denkraum gate for precommit/prepush/branchpush/linux, but not windows. The existing merge-queue Windows lane alone therefore does not execute this new Node test. The orchestrator must arrangenode --test tools/denkraum/config.test.mjs tools/denkraum/server-gate.test.mjson Windows with 8.3 enabled; gate changes are outside the four-file authorization.#[cfg(windows)]tests or Windows clippy branches; that native Windows coverage belongs to the merge queue.lage-jetztmirror was unavailable; live Git and GitHub sources were checked. The harness identifies the worker as Codex, but exposes no exact served-model identifier/effort or current quota measurement; these are not claimed as observed.Review and handover
Review: ausstehend (Stufe A).
No reviewer was started by this worker. The orchestrator owns independent review of the changed candidate, Windows proof, acceptance and queue admission. A3–A6 remain follow-up. Existing draft state is retained; no readiness, labels or merge action was taken.
Native goal evidence: initial
get_goalreturned null;create_goalreturned active for the bounded fix1 handover; the post-pushget_goalstill returned active pending this report update. Parent Z1 acceptance is separate from worker delivery.Root-Abnahme (09.10.2026, head b43e87c)
config.test.mjs"physical STATE checks…" callssymlinkSyncwithout the EPERM skip guard of its sibling testTier A: authors Cursor auto (r1, family unknown) + Codex gpt-6-astra (fix1, OpenAI). Reviewers: Anthropic (approve with conditions → met) and Zhipu/GLM 5.2 (approve with conditions → disposed as follow-up above, no runtime defect on our CI platforms). Bound to head b43e87c. GLM report: Root scratchpad review_pr750_glm-5.2.md (prompt sha256 in header).