Validate Guardian internal quality evidence

[hiciefte]

Problem and change

Guardian's scheduled polls failed while preparing corrections for Bisq2 #5059. Locally detected quality findings cite the commit that was checked, but publication sent those links through a validator that only accepts reviewer-comment links.

Validate internal quality evidence separately against its exact authorized revision. Reviewer links retain their existing PR-specific restrictions. Original evidence revisions remain usable only through Guardian's recorded publication history, so later corrections can preserve their source evidence.

Validation

• 32 focused tests passed, covering private-only and mixed corrections at the real commit boundary, controller publication routing, malformed or mismatched evidence, and recorded revision history.
• Independent review found no blocking issues; Ruff and diff checks passed.
• Full local suite: 3,265 passed, one skipped, and 13 subtests passed.
• Replayed the two exact stored findings from the failed #5059 run against live GitHub PR identity; both validated and shared one canonical source-commit link.
• All required CI passed at d2ab7bc6b920b0eba6f1e9af406452678b7de23d, including Python 3.11/3.12, Docker/Trivy, and CodeQL.
• CodeRabbit completed an actual review of the same commit with no actionable findings and all pre-merge checks passed.
• The deployment wheel matches all 68 application files in the verified signed commit.

[coderabbitai]

Navigate logical layers of code changes, visualize relationships, and explore their blast radius.

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Advanced

Run ID: 57f0a924-cee7-48b2-bbcc-8dded6177f8e

📥 Commits

Reviewing files that changed from the base of the PR and between 8001b6c and d2ab7bc.

📒 Files selected for processing (5)

• docs/guardian.md
• localize/guardian/controller.py
• localize/guardian/workspace.py
• tests/unit/test_guardian_controller.py
• tests/unit/test_guardian_workspace.py

Included review availability: This review used your included allowance. Your plan provides up to 1 included review per hour; 0 remain after this review.

---

📝 Walkthrough

Walkthrough

Guardian now validates private quality-finding evidence against the pull request and report lineage. The workspace records validated commit links separately from reviewer feedback. Public feedback still requires an exact pull-request comment link.

Changes

Private quality evidence

Layer / File(s)	Summary
Validate and record commit evidence localize/guardian/workspace.py, tests/unit/test_guardian_workspace.py	The workspace validates quality-finding URLs against the repository and full commit SHA. It records them in a separate commit-message section. Tests cover exact matches, invalid URL components, missing anchors, and separation from feedback links.
Validate and publish private findings localize/guardian/controller.py, tests/unit/test_guardian_controller.py, docs/guardian.md	The controller validates finding identity and report lineage, separates quality findings from ordinary feedback, and passes the validated URL and anchor SHA to the workspace. Tests cover lineage, invalid findings, deduplication, and publication.

Priority: ⬇️ Low

Estimated code review effort: 3 (Moderate) | ~20 minutes

Change: Bug fix

Sequence Diagram(s)

sequenceDiagram
  participant Controller as Guardian controller
  participant Workspace as GuardianWorkspace
  participant Commit as Signed correction commit
  Controller->>Workspace: pass validated finding URL and anchor SHA
  Workspace->>Workspace: validate URL against repository and SHA
  Workspace->>Commit: add validated quality-finding evidence

Loading

Merge Risk: ⚪ Minimal · up to d2ab7

No actionable issue remains from this review. Merge after the required CI checks pass.

Security Architecture Review

Security architecture risk: 🔵 Low · up to d2ab7

The reviewed publication path preserves exact revision checks and reviewer-link restrictions. No introduced vulnerability was identified, but coverage of integration paths outside the reviewed flow remains incomplete.

Retained concerns
No architecture-level concerns identified.

Security review details

Security Blast Radius

• observed — On the inspected controller path, evidence acceptance is bound to the configured actor, repository and repository IDs, PR identity, current head/base, and authorized evidence anchor. The changed sink is correction-commit metadata, not unrestricted URL fetching.

Trust Boundaries and Controls

• observed — Report and event values are checked before becoming commit evidence. Exact URL equality prevents arbitrary hosts, fragments, queries, or injected metadata from entering the private channel. Reviewer links retain independent host, repository, PR-path, and comment-fragment restrictions.
• observed — The workspace validates the evidence SHA's syntax and its URL binding but delegates revision authorization to the controller. Known runtime wiring supports this trusted-caller contract; complete reachability outside that wiring remains unestablished.

Resilience and Maintainability Implications

• observed — Publication history lookup is scoped by repository identity, PR, head, and publication actor. Repeated phase writes are identity-checked, and lease checks constrain concurrent transitions, protecting the durable history used to authorize later evidence reuse.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	Docstring coverage is 86.96% which is sufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 23 functions across 4 files. (1 skipped: 1 …
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely describes the main change: validating Guardian internal quality evidence separately from reviewer feedback.

✨ Finishing Touches

📝 Generate docstrings

• Commit to this branch
• Create a new PR

• Autopilot · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Autopilot is currently an internal CodeRabbit preview.

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{I’m a rabbit with a commit link to bring,
I check the right SHA before offering,
Findings and feedback now travel apart,
A signed correction records their part,
Then I hop home, content with my chart.}

_{Comment @coderabbitai help to get the list of available commands.}