Adopt immutable contracts for Prompt SDK 1.0.0 (#72) - #16
Conversation
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 0abc5be370
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| for (const name of names) { | ||
| const matches = Array.isArray(lock?.contracts) ? lock.contracts.filter(entry => entry?.contract === name) : []; | ||
| const entry = matches[0], pin = pins?.[name]; | ||
| const assets = Array.isArray(entry?.assets) ? entry.assets.filter(asset => asset?.media_type === 'application/schema+json') : []; |
There was a problem hiding this comment.
If a bundle entry is removed or its filename, URI, size, or digest is corrupted while the schema entry remains intact, this filter discards that evidence and checkReleaseInputs() still returns { ready: true }. The release guide requires complete manifests and exact asset tuples before enabling stable lifecycle, so the readiness gate must verify the expected schema and bundle records—and reject unexpected or missing assets—rather than validating only the schema asset.
Useful? React with 👍 / 👎.
1 participant
Summary
Verification
Remaining publication gate
Part of DefinitelySecureStudio/studio#72. After owner merge and successful CI, build/inspect and publish the final Platform prompt-sdk/v1.0.0 artifact release. Keep #72 and Epic #4 open until that release is verified. The Codex contract releases are already published; this PR does not yet publish the Platform implementation artifact.