feat(activity): add safe action locators by roodboi · Pull Request #63 · hack-dance/fclt

roodboi · 2026-07-15T16:17:37Z

Summary

add an optional opaque, versioned action locator to actionable activity items
add read-only CLI/JSON resolution that revalidates machine-local scope, persisted runtime identity, canonical root identity, activity run, queue revision, resource lifecycle, and allowed action class
expose the resolver through an action-closed fclt_registry MCP schema with no caller root, cwd, argv, credential, approval, or mutation fields
keep legacy, missing-proposal, non-actionable, and alternate-Global-root items handoff-only
document versioning, expiration, errors, and the explicitly withheld mutation boundary

Safety

Resolution is read-only and returns safe metadata plus a plain-language plan. Locator-bound mutation is unavailable in v1. Root replacement, ancestor symlinks, copied state, duplicate internal IDs, duplicate worktrees, stale revisions, malformed state, and incompatible locators fail closed.

Verification

bun run check
bun run type-check
./scripts/test-safe.sh --max-concurrency 1 — 572 passed
bun run build
bun run build:verify
bun run pack:dry-run
bun run bootstrap:verify
generated built-in/plugin parity tests
changed-surface privacy scan and git diff --check
two independent exact-diff security/contract reviews clean

linear-code · 2026-07-15T16:17:40Z

HACK-931

roodboi · 2026-07-15T16:18:02Z

@codex review

Please review exact head b291a59f5871a92d72331fb100345bb3d67da4ff. The serial 572-test suite, typecheck, lint/format check, compiled binary verification, package/bootstrap verification, generated-plugin parity, privacy scan, and two independent adversarial contract/security reviews are clean.

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: b291a59f58

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

roodboi · 2026-07-15T16:33:29Z

@codex review

Exact head: 44fafc1. Both prior findings are fixed, replied to, and resolved with regression evidence.

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 44fafc17a4

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

roodboi · 2026-07-15T20:09:21Z

@codex review

Please review exact head fefcd50e9928378dc84171c4349eec046a8b0152. The remaining locator-identity finding is fixed, replied to, and resolved. This head is rebased onto current main 33f5615a80343678e757d90e00cd91c75ebb3e6b; hosted CI is authoritative under the approved local timing-gate waiver.

roodboi · 2026-07-15T20:10:29Z

@codex review

Please review exact head bbbf4d8. This differs from the prior requested head only by the formatter output reported by hosted CI; the locator-identity fix and regression are unchanged. Hosted CI has restarted and remains authoritative under the local timing-gate waiver.

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: bbbf4d86e5

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

roodboi · 2026-07-15T20:18:24Z

@codex review

Please review exact head 916e861. The source-set staleness finding is fixed, replied to, and resolved with cadence-preservation and source-change-rotation regressions. Hosted CI is authoritative under the approved local timing-gate waiver.

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 916e861825

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

roodboi · 2026-07-15T20:26:03Z

@codex review

Please review exact head 2cfdaeb. The over-cap project-discovery finding is fixed, replied to, and resolved with a regression proving Global resolution remains available while project resolution fails closed. Hosted CI is authoritative under the approved local timing-gate waiver.

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 2cfdaeb6c2

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

roodboi · 2026-07-15T20:35:23Z

@codex review

Please review exact head ae7098f. The legacy proposal-ID compatibility finding is fixed, replied to, and resolved with an EV-LEGACY locator round-trip regression. Hosted CI is authoritative under the approved local timing-gate waiver.

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: ae7098fe84

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

roodboi · 2026-07-15T20:48:40Z

@codex review

Please review exact head 137364120f56c77b942d7a3a7a14c9a4309d90b3. The two prior findings are addressed with failed-snapshot locator preservation and runtime capability gating; local timing-sensitive gates remain intentionally waived, so hosted exact-head CI is authoritative.

roodboi · 2026-07-15T20:48:55Z

@codex review

Correction: please review exact head 1373641. The immediately preceding request contained a mistyped expanded SHA; the PR head itself was already this commit.

roodboi · 2026-07-15T20:50:48Z

@codex review

Please review exact head 27f5b9a3ab8cc5ff67c19c88c627dcaf0ce60766. This is the prior product fix plus a one-line regression-selector correction identified by hosted CI; no production code changed after 1373641.

roodboi · 2026-07-15T20:50:59Z

@codex review

Correction: please review exact head 27f5b9a. The PR head is authoritative; the immediately preceding expanded SHA was mistyped.

chatgpt-codex-connector · 2026-07-15T20:53:08Z

Codex Review: Didn't find any major issues. Hooray!

Reviewed commit: 27f5b9affc

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

## [2.26.0](v2.25.4...v2.26.0) (2026-07-15) ### Features * **activity:** add safe action locators ([#63](#63)) ([693d2ac](693d2ac))

github-actions · 2026-07-15T20:56:59Z

🎉 This PR is included in version 2.26.0 🎉

The release is available on GitHub release

Your semantic-release bot 📦🚀

chatgpt-codex-connector Bot reviewed Jul 15, 2026

View reviewed changes

Comment thread src/evolution-loop.ts Outdated

Comment thread src/evolution-loop.ts Outdated

chatgpt-codex-connector Bot reviewed Jul 15, 2026

View reviewed changes

Comment thread src/evolution-loop.ts

roodboi added 3 commits July 15, 2026 16:07

refactor(activity): share project scope identity

39bb501

feat(activity): add safe action locators

0d4f05e

fix(activity): serialize locator issuance

2780303

roodboi force-pushed the codex/hack-931-action-locators branch from 44fafc1 to fefcd50 Compare July 15, 2026 20:08

roodboi force-pushed the codex/hack-931-action-locators branch from fefcd50 to bbbf4d8 Compare July 15, 2026 20:10

chatgpt-codex-connector Bot reviewed Jul 15, 2026

View reviewed changes

Comment thread src/evolution-loop.ts Outdated

fix(activity): preserve locator identity on reconfiguration

916e861

roodboi force-pushed the codex/hack-931-action-locators branch from bbbf4d8 to 916e861 Compare July 15, 2026 20:17

chatgpt-codex-connector Bot reviewed Jul 15, 2026

View reviewed changes

Comment thread src/activity-action.ts Outdated

fix(activity): preserve global resolution under project cap

2cfdaeb

chatgpt-codex-connector Bot reviewed Jul 15, 2026

View reviewed changes

Comment thread src/activity-action.ts Outdated

fix(activity): resolve legacy proposal locators

ae7098f

chatgpt-codex-connector Bot reviewed Jul 15, 2026

View reviewed changes

Comment thread src/evolution-loop.ts

Comment thread plugins/fclt/scripts/fclt-mcp.cjs

fix(activity): close resolver compatibility gaps

1373641

test(activity): select failed proposal item

27f5b9a

roodboi merged commit 693d2ac into main Jul 15, 2026
3 checks passed

roodboi deleted the codex/hack-931-action-locators branch July 15, 2026 20:54

github-actions Bot pushed a commit that referenced this pull request Jul 15, 2026

chore(release): 2.26.0

90e425f

## [2.26.0](v2.25.4...v2.26.0) (2026-07-15) ### Features * **activity:** add safe action locators ([#63](#63)) ([693d2ac](693d2ac))

github-actions Bot added the released label Jul 15, 2026

Uh oh!

Conversation

roodboi commented Jul 15, 2026

Summary

Safety

Verification

Uh oh!

linear-code Bot commented Jul 15, 2026

Uh oh!

roodboi commented Jul 15, 2026

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

Uh oh!

Uh oh!

roodboi commented Jul 15, 2026

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

Uh oh!

roodboi commented Jul 15, 2026

Uh oh!

roodboi commented Jul 15, 2026

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

Uh oh!

roodboi commented Jul 15, 2026

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

Uh oh!

roodboi commented Jul 15, 2026

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

Uh oh!

roodboi commented Jul 15, 2026

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

Uh oh!

Uh oh!

roodboi commented Jul 15, 2026

Uh oh!

roodboi commented Jul 15, 2026

Uh oh!

roodboi commented Jul 15, 2026

Uh oh!

roodboi commented Jul 15, 2026

Uh oh!

chatgpt-codex-connector Bot commented Jul 15, 2026

Uh oh!

Uh oh!

github-actions Bot commented Jul 15, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant