Harden host-bot Codex and agent workflows - #26
Conversation
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
|
@codex review |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: b1b1131f66
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
|
@codex review |
|
Codex Review: Didn't find any major issues. Already looking forward to the next diff. Reviewed commit: ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. Codex can also answer questions or update the PR. Try commenting "@codex address that feedback". |
|
@codex review |
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 1b40c6ad20
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
|
@codex review |
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: a6e7bb961e
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
|
@codex review |
|
Codex Review: Didn't find any major issues. You're on a roll. Reviewed commit: ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. Codex can also answer questions or update the PR. Try commenting "@codex address that feedback". |
9ccae00 to
fd91c17
Compare
simeonwarrenbot
changed the title
|
@codex review LLM-disclaimer: This comment was generated by an LLM. |
fd91c17 to
fd4fe52
Compare
|
@codex review LLM-disclaimer: This comment was generated by an LLM. |
|
Codex Review: Didn't find any major issues. 👍 Reviewed commit: ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. Codex can also answer questions or update the PR. Try commenting "@codex address that feedback". |
fd4fe52 to
cb42a38
Compare
|
@codex review LLM-disclaimer: This comment was generated by an LLM. |
Harden the disposable Fedora Silverblue host's managed Codex profile while preserving public network access, unrestricted hosted search, the Blender MCP, the low-privilege SSH agent, and full Bazel and Bazelisk cache access. Deny local and private network targets, retain the pinned Android NDK path, and keep task scratch and configurable temporary data under ignored `out/<task>` directories excluded from both Git and Bazel package discovery. Package Bazelisk v1.29.0 as a checksummed third-party tool, pin the Bazel 8.7.0 archive, and install Bazelisk before maintaining the host's `bazel` symlink. Provision the Go `bazel_agent` runner through the host-bot role, give it an atomic installer, inject batch mode and `--config=agent` while replacing itself with the PATH-selected Bazel, migrate agent Bazel calls, and make the repository hook fail closed with bootstrap guidance when the runner is unavailable. Add repository skills for Bazel-agent usage, reproducible external dependencies, and evidence-based question answering. Route every substantive question through the question skill without treating it as authority to act. Make delivery maintain one aggregate feature commit, rebase onto the freshly fetched pull-request base before every push, use a race-safe explicit lease, synchronize pull-request title and description from the commit with type-specific disclaimers, and revalidate review after amendments. Verification: - `git diff --check` - strict Codex configuration and effective app-server requirements checks - managed-sandbox network, cache, Bazelisk cold-start, and write-boundary probes - `bazel_agent` unit, full-repository-checker, Git-hook, and Buildifier tests - packaged builds for the changed skills and `//projects/bazel_agent:all` - installed-runner pass-through, query, and atomic installation checks - Bazelisk version and pinned Bazel archive checks - Bazel-ignore sentinel probe for `out/` - host-bot Ansible build, syntax, runfiles, and live-policy checks - schema validation and forward testing for the delivery and question skills LLM-disclaimer: This commit was generated by an LLM.
cb42a38 to
92831be
Compare
|
@codex review LLM-disclaimer: This comment was generated by an LLM. |
|
Codex Review: Didn't find any major issues. Can't wait for the next one! Reviewed commit: ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. Codex can also answer questions or update the PR. Try commenting "@codex address that feedback". |
2 participants
Harden the disposable Fedora Silverblue host's managed Codex profile while
preserving public network access, unrestricted hosted search, the Blender MCP,
the low-privilege SSH agent, and full Bazel and Bazelisk cache access. Deny
local and private network targets, retain the pinned Android NDK path, and keep
task scratch and configurable temporary data under ignored
out/<task>directories excluded from both Git and Bazel package discovery.
Package Bazelisk v1.29.0 as a checksummed third-party tool, pin the Bazel 8.7.0
archive, and install Bazelisk before maintaining the host's
bazelsymlink.Provision the Go
bazel_agentrunner through the host-bot role, give it anatomic installer, inject batch mode and
--config=agentwhile replacing itselfwith the PATH-selected Bazel, migrate agent Bazel calls, and make the repository
hook fail closed with bootstrap guidance when the runner is unavailable.
Add repository skills for Bazel-agent usage, reproducible external
dependencies, and evidence-based question answering. Route every substantive
question through the question skill without treating it as authority to act.
Make delivery maintain one aggregate feature commit, rebase onto the freshly
fetched pull-request base before every push, use a race-safe explicit lease,
synchronize pull-request title and description from the commit with
type-specific disclaimers, and revalidate review after amendments.
Verification:
git diff --checkbazel_agentunit, full-repository-checker, Git-hook, and Buildifier tests//projects/bazel_agent:allout/LLM-disclaimer: This pull request was generated by an LLM.