[dinakarjs]

Problem and change

Carry the canonical WCM #249 checker repair: preserve whitespace inside quoted marker literals, refuse symlink/non-regular lock paths, and retain lexical Git baseline names. The changed-lock driver also refuses symlink locks and a symlink requirements directory. Existing hash-set comparison, full generated-lock discovery, rename/deletion refusal and repository exclusions remain.

Validation — 1 November 2026

Head: f1f414a049ddbb0209cc3680536a1b50887b3b40; tree: 70129544def5554b4bc04188676d7b95963c2928.

• Standard-library guard discovery: 20 tests pass normally and 20 under optimized Python.
• New controls cover both quote styles, explicit/inventory CLI paths and the real-Git changed-lock driver with a symlink replacing a lock that has an additional dependency.
• The checker is byte-identical to repaired WCM feat(docker-sandbox-kit): bind a Sandbox Kit v3 descriptor as a declared TRACE policy #249. Source regressions demonstrate failures with whitespace collapse or symlink refusal restored to old behavior.
• Whitespace checks pass. No fresh full SDK/runtime suite is claimed for this tooling-only follow-up.

Adoption hold

Draft retained. Independent acceptance of WCM #249's new head comes first, followed by this repository's own current-head review and hosted gates. Prior-head approvals are historical; no organization-wide mandate or merge/release is claimed.

Implementation and follow-through: @dinakarjs. Prepared with OpenAI Codex; DCO-signed.

[github-actions]

🟡 Contributor Check: MEDIUM

Check	Result
Profile	MEDIUM
Credential	LOW
Overall	MEDIUM

Automated check by AgenTrust Contributor Check.

[dinakarjs]

The new Generated lock delta, workflow lint and integration validation jobs pass. Remaining examples/links failures are the existing repository issues tracked by #362 and #357. This port remains draft while the source WCM #249 checker and this repository-specific scope receive independent review.

[carloshvp]

Reviewed exact head 9bb270150bc894d4632e22b5182ff50f32fd142f in an isolated checkout. Requesting one correction to the generated-lock driver before adoption.

The five committed unittest methods pass. An independent temporary-Git regression renames requirements/dev.txt to requirements/renamed.txt while dropping one of ten exact, hash-pinned dependencies. Git reports R090; the actual driver exits 0 and prints NEW requirements/renamed.txt: structure only; no prior dependency baseline. This reproduces both normally and under python -O.

git diff --name-only applies rename detection and emits only the destination. The old lock never reaches the deleted-lock guard, and the new pathname bypasses comparison with its predecessor, so both deletion and dependency loss escape the advertised review requirement. Please enumerate additions/deletions with rename detection disabled, or explicitly handle rename source/destination pairs and compare their dependency identities. Add a real-Git rename-plus-removal regression alongside the existing deletion and upgrade controls.

This is a defect in the proposed CI guard, not evidence of an installed dependency or production security bypass. The source WCM checker review and this draft's repository-specific acceptance remain separate.

Reviewed with OpenAI Codex.

[dinakarjs]

@carloshvp addressed the rename finding at ed8d9ff. The driver now passes --no-renames to git diff so the deleted source lock reaches the existing explicit-review guard, even when Git would classify the change as R090/R100. A real temporary-Git regression verifies rename classification and checks both unchanged renames and rename-plus-dependency-removal, normally and under python -O. All four controls fail on the old driver; all six unittest methods pass with the repair, including existing upgrade/deletion controls. Syntax/pyflakes lint and whitespace pass. The documentation makes the conservative rename policy explicit. No dependency pins or runtime behavior changed. Please re-review; draft and independent acceptance gates remain. Prepared with OpenAI Codex.

[carloshvp]

Reviewed current head ed8d9ffb7584f52d667937cd093118b68dbc6034.

The --no-renames repair closes the previously reproduced rename/dependency-removal bypass. In an isolated checkout, all six unittest methods pass normally and under python -O; removing only --no-renames makes all four rename controls fail. DCO trailers are present where required.

One remaining CI gap needs fixing: the workflow selects only test_lock_delta.py, so the new test_lock_renames.py regression never runs in the advertised guard job. Its path is also absent from the trigger filter. Use a discovery pattern and path filter that include both test modules, and run that workflow command normally and under -O. Keep the PR draft until its separate acceptance requirements are satisfied. Existing repository checks and independent acceptance remain separate.

Prepared with OpenAI Codex.

[dinakarjs]

@carloshvp addressed the CI discovery gap at 40d52e2. The workflow and path filter both use test_lock_*.py, which includes the delta and rename modules; its regression step runs in normal and optimized (-O) modes. Both exact commands pass six unittest methods locally on Linux/Python 3.12.14, and whitespace checks pass. The published tree is the tested parent tree plus only this workflow edit. Draft retained pending independent source-checker/port acceptance and normal repository checks. Please re-review the updated head. Prepared with OpenAI Codex; DCO-signed.

[dinakarjs]

Hosted validation follow-up at 40d52e2: Generated lock delta and all returned applicable technical workflows now succeed. Primary run: https://github.com/agentrust-io/integrations/actions/runs/40918596493. The CI discovery repair is now verified by the hosted guard job as well as the local normal/-O controls. Draft status and independent source-checker/port acceptance remain unchanged. No merge or publishing workflow was performed. Prepared with OpenAI Codex.

[carloshvp]

Reviewed current head 40d52e2301a7bcf3cd50e2bc33e25819e7a2045d.

The CI discovery and trigger filters now include both test_lock_delta.py and test_lock_renames.py, and the workflow runs the same discovery command normally and under -O. I independently ran both commands: all six unittest methods pass in each mode, including the real-Git rename/dependency-loss controls. The four ports contain identical checker/driver code; sign-offs and diff whitespace checks pass.

This resolves my previous CI-discovery change request. Approving this bounded port implementation; keep the draft status until the separate source-checker/adoption decision and repository acceptance requirements are satisfied. This review does not adopt a cross-project policy or approve WCM #249 on its behalf.

Reviewed with OpenAI Codex.

[dinakarjs]

@carloshvp requesting re-review of the subsequent hash/inventory corrections at 746e0860eeec64d67de598bce18c71b8d20669d6. Your prior CI-discovery review applies to an older revision; this changed head still needs independent disposition.

I verified the current Git trees: tools/check_lock_delta.py is identical to WCM #249 source head 9fcf6bd6684dbd87473d1b0c670eaeb154749a75 (blob 4c702425da6ed1c554bcdcbd78245b2d9e9ee62d). The four ports also have identical driver, workflow and four regression-module blobs. Their repository exclusions remain separate.

The current-head guard job logs confirm that test_lock_*.py discovers 18 tests and passes in both normal and optimized Python, followed by successful execution of check_changed_locks.py against the PR base. This verifies the hosted discovery/execution path, not just a workflow-level green result. All other returned current-head technical workflows also succeed; the remaining returned failure is the independent maintainer/policy gate.

WCM #249 source acceptance has been requested explicitly from Imran/Rajnish and remains pending. Please review this port's updated implementation and identify remaining changes; keep draft/adoption holds until source acceptance and this repository's requirements are met. No new local suite run, source acceptance or merge is claimed by this status update. Prepared with OpenAI Codex.

[dinakarjs]

@carloshvp requesting bounded re-review of current head f1f414a049ddbb0209cc3680536a1b50887b3b40.

The subsequent WCM #249 repair is carried here: quoted marker whitespace is preserved, lexical baselines are retained, and symlink lock paths are refused by the checker and changed-lock driver. Recorded local guard discovery passes 20 tests normally and under optimized Python. All returned current-head technical workflows pass.

Please review this updated port and identify any remaining correction. Draft status is retained pending independent acceptance of WCM #249 at a5e523f54a8ac08e8c7adb8503de2a5c37a5f43f and this repository's own acceptance. This request does not adopt a cross-project policy or imply that prior-head approval covers the new source. Validation details and scope are in the description; no new local rerun is claimed by this follow-up. Prepared with OpenAI Codex.