feat: complete, harden, and package native review workflows

[jedwards27]

Summary

• finalize every recorded Desktop/iOS native-review run as a Buzz-compatible H.264 MP4
• add a finding-bundle command for optional clipping, focused/redacted logs, minimal receipt provenance, and hashed manifest
• fail the receipt if shareable evidence finalization fails instead of silently omitting the artifact

Stacked on #5972 because the native-review harness has not landed on main yet.

Validation

At exact clean head 2b74739e0f7869c559612dcedb4b61b7094c7aab:

• python3 -m unittest discover -s tools/native-review/tests -p 'test_*.py' — 29/29 pass
• pre-push hooks — branch skew, Desktop check/typecheck/4,954 tests, mobile tests, Rust tests, and Tauri checks all pass
• just native-review-ios 'iPhone 17 Pro' — passes on iOS 26.5; receipt clean and cleanup passes
• generated video-share.mp4 is H.264/yuv420p, 994×2160, and accepted by the live Buzz upload endpoint
• the finding-bundle command converted the PR Polish mobile message actions #5873 failing simulator receipt into a 1.2 MB shareable MP4 plus focused disposed-image log excerpt, minimal receipt, and SHA-256 manifest; live upload accepted it

Receipt: test-results/native-review/2b74739e0f78/ios_pairing/ios-20260815T120507-595304/receipt.json

[themiguelamador]

Blocking findings:

1. The documented native-review command/test path imports PyYAML, but the dependency is neither installed nor pinned; it fails from a clean checkout even after Hermit activation.
2. The evidence redactor leaks common secret forms (Authorization: Bearer …, JSON keys such as "token": "…") and copies receipt failure/cleanup strings without recursive redaction, so a bundle described as privacy-safe can disclose credentials.
3. The AVAssetWriter capture loop does not advance its frame clock while the writer is backpressured. Its sleep target then remains in the past and the driver busy-spins, perturbing the performance run it is measuring.
4. scroll accepts a target locator but posts at the mouse's previous position, so journeys can scroll the wrong view.
5. iOS receipts omit the common schema fields (flow, timestamps, isolation, steps, measurements, performance) and add an undeclared device, making them invalid against the checked-in receipt schema and producing incomplete publication provenance.
6. Journey/performance/media inputs accept malformed durations, duplicate samples, booleans, and non-finite numbers; some fail late, while duplicate receipts can satisfy the minimum cohort size without independent runs.

Fixed in Complear/buzz@b3562d00e (branch review/pr-5972-fix): pinned uv/PyYAML environment, comprehensive evidence redaction, backpressure-safe capture scheduling, locator-targeted scrolls, schema-compatible iOS receipts, and fail-closed input validation with regression coverage. Verification: native-review 50/50, Swift release build, desktop 4,954/4,954 plus lint/typecheck, mobile 1,417/1,417 plus analysis, shell/JSON/Python syntax checks.

[jedwards27]

Implemented the requested hardening in b854c00ea29afedf7634c86ac5febdbf36ad3a85 (including the base merge). The six blocking points are addressed as follows:

1. Clean PyYAML provisioning: both launchers now use explicit uv run --with pyyaml==6.0.3; fresh empty-cache desktop and iOS --help runs pass. The inaccessible internal-Artifactory project/lock was removed.
2. Recursive secret redaction: nested receipt/failure/cleanup content is redacted, including JSON, single-quoted, environment-style, and Authorization: Bearer forms. The original JSON leak probe now emits {"authorization": "[REDACTED]"}.
3. Capture backpressure: the frame schedule advances while AVAssetWriter is not ready, preventing a stale deadline and busy-spin.
4. Locator-targeted scroll: scroll resolves the target locator and posts at the target element rather than the previous mouse position.
5. Schema-compatible iOS receipts: iOS output now conforms to the common receipt schema and carries the required flow/timestamp/isolation/step/measurement/performance provenance without the undeclared device field.
6. Fail-closed validation: malformed/non-finite/bool numeric values, missing or zero waits, zero sustained durations, repeated run IDs, and cross-cohort reused artifact paths are rejected; regression coverage was added.

Exact-head validation was performed independently twice on b854c00e:

• native-review Python suite: 50/50 passed
• all three desktop journey schema validations: passed
• Swift release build: passed
• Python compile and launcher shell syntax: passed
• desktop and iOS launchers with fresh empty uv caches: passed
• targeted redaction, duplicate-run/path, and duration/wait probes: passed
• both validating checkouts were clean and matched the PR head OID

GitHub currently reports the PR as mergeable at this SHA. DCO passes; other repository checks/review requirements remain pending. Any head change invalidates the exact-head evidence above.

Please re-review b854c00ea29afedf7634c86ac5febdbf36ad3a85.

[jedwards27]

Reviewing exact head b854c00ea29afedf7634c86ac5febdbf36ad3a85 against base a362fecc2389955f942c9581bdfeba379ab115b3, I still found three blocking gaps:

1. [P2] The privacy-safe bundle leaks GitHub-style Authorization credentials. In tools/native-review/evidence_bundle.py:15-20,73-80, Authorization: token ghp_supersecret becomes Authorization: [REDACTED] ghp_supersecret: the generic key matcher consumes token as the value and leaves the credential. Redact the complete value of credential-named headers/keys independent of auth scheme, and add this exact regression case plus representative schemes.

2. [P2] Runtime journey validation accepts values outside the checked-in schema and native numeric contract. tools/native-review/review_native.py:222-235 accepted wait.duration_ms: 30001, expect_for.duration_ms: 30001, and scroll.delta_y: 2147483648, despite the bounds in tools/native-review/schemas/journey.schema.json:36,60,64. The oversized wait can outlive the driver's fixed response timeout, while the oversized scroll reaches the Int32 conversion at tools/native-review/swift/Sources/BuzzNativeDriver/main.swift:524-525,565 and can trap the driver. Enforce matching upper/lower bounds in load_journey, align the schema's wait minimum with runtime's positive-only rule, and cover boundary plus over-bound rows.

3. [P1] The two Swift driver remediations still have no causal automated regression coverage. The backpressure scheduling change exists only at tools/native-review/swift/Sources/BuzzNativeDriver/main.swift:332-360, and targeted scroll placement only at main.swift:531-571. There is no Swift test target; the Python test at tools/native-review/tests/test_review_native.py:26-37 only parses broken-scroll.yaml. Reverting either remediation therefore leaves all 50 tests green, contrary to the defect-reintroduction evidence required by tools/native-review/README.md:150-161. Extract/test frame/deadline advancement under repeated writer backpressure and scroll event location from the freshly resolved target frame, then mutation-check each test. Preserve inspected failed/green native receipts for the cross-layer scroll workflow as requested by that contract.

Exact-head evidence: Python native-review suite 50/50 passed; Swift release build passed; Python/JSON/shell syntax gates passed; source inspection covered the remediation areas. Fresh empty-cache launcher provisioning was inconclusive because the configured internal mirror failed TLS and the public-PyPI control was blocked by dependency-confusion policy, so I am not attributing that environmental failure to this PR. No exact-head native Desktop/iOS journey receipt was available. Live GitHub state immediately before this review was MERGEABLE/BLOCKED, with DCO passing and the prior change request unresolved.

Verdict: changes remain required. GitHub does not permit this PR author's account to submit a second formal request-changes review on its own PR; this comment records the fresh exact-head team review, while the existing request-changes review remains open.

[jedwards27]

:bot: Jude’s code review agent — changes remain required on exact head b854c00ea29afedf7634c86ac5febdbf36ad3a85.

Reviewed a362fecc2389955f942c9581bdfeba379ab115b3..b854c00ea29afedf7634c86ac5febdbf36ad3a85 from two independent fresh lenses; prior clearance was not reused.

1. [P2] Authorization redaction still leaks common scheme credentials — tools/native-review/evidence_bundle.py:15-20,73-80. Authorization: token ghp_supersecret becomes Authorization: [REDACTED] ghp_supersecret, leaving the credential in the supposedly privacy-safe bundle. Redact the entire value of credential-named headers/keys and add this plus representative scheme regressions.
2. [P2] Runtime validation accepts out-of-schema values that can time out or trap the native driver — tools/native-review/review_native.py:222-235, schema bounds at tools/native-review/schemas/journey.schema.json:36,60,64, and native conversions at tools/native-review/swift/Sources/BuzzNativeDriver/main.swift:524-525,565. The exact head accepts 30,001 ms waits/sustained assertions and delta_y=2147483648; these can exceed the fixed request timeout or overflow Int32. Enforce schema bounds in runtime validation, align the wait minimum, and add boundary/over-bound tests plus defensive exact conversion.
3. [P2] The recorder-backpressure and target-scroll fixes lack causal automated coverage — production paths at tools/native-review/swift/Sources/BuzzNativeDriver/main.swift:332-360,531-571. The Swift package has no test target; the Python suite parses broken-scroll.yaml but never observes native event location. All 50 tests still pass if either Swift fix is reverted. Add focused Swift seams/tests for frame advancement under backpressure and fresh-target scroll location, then mutation-prove each regression test.

Exact-head checks otherwise passed: native-review Python 50/50, Swift release build, all production journey validations, Python/JSON/shell checks, clean tree, and matching live/local OIDs. Fresh-cache provisioning could not be re-established in this environment because the configured Block mirror failed TLS; that is recorded as unverified rather than a separate finding. No GUI/native journey was launched under the shared-machine safety rule.

GitHub remains MERGEABLE/BLOCKED with DCO as the only materialized check. Please address all three findings and request a new exact-head review; any push invalidates this result.

[jedwards27]

All six blocking findings have been addressed, and the repaired branch is now at exact head 9623b4ac338263ee52277ce195ec4f0ab900b465 (merged with current upstream main).

Remediation summary:

1. The harness runs in the repo's pinned Hermit/uv environment with PyYAML available.
2. Evidence redaction now recursively handles credential-shaped keys and redacts the entire value of Authorization / Proxy-Authorization headers regardless of scheme or structured-log placement. Regression rows cover token fields, nested receipt strings, Digest, Negotiate, Custom, Bearer, Basic, indented/embedded headers, folded values, and JSON/assignment forms.
3. AVAssetWriter backpressure advances the capture clock instead of spinning on a stale deadline.
4. Targeted scroll events are created at the resolved locator frame rather than the prior pointer position.
5. iOS receipts conform to the checked-in receipt schema and retain device provenance under declared fields.
6. Runtime input validation now matches journey/schema bounds, rejects booleans/non-finite values, and preserves independent performance-cohort requirements.

Fresh exact-head evidence at 9623b4ac:

• native-review Python suite: 53/53 passed
• Swift support suite: 3/3 passed
• Swift release build: passed
• causal mutation checks: reverting blocked-tick advancement or target-frame event placement makes the corresponding Swift test fail
• full mobile suite in the activated repo toolchain: passed on the pre-push run; an earlier concurrent broad run had one liveness timing failure (detects a peer that stops answering pings), which passed immediately when rerun alone at the same SHA
• git diff --check: passed; worktree clean
• DCO Check: passed on the published head

Independent adversarial review also returned CLEAR at this exact SHA for both lanes: Swift/native-runtime integration and mutation sensitivity; and redaction/security plus runtime/schema behavior. No live GUI AVAssetWriter/CGEvent journey was run, so the native evidence here is release compilation plus causal unit/mutation coverage rather than a claim of end-to-end GUI execution.

Please re-review the current head.

[jedwards27]

:bot: Jude’s code review agent

Verdict: changes remain required. Reviewed current PR base bbd20fae75ecc3bd7a83cc12a65379fac22a2b79 through exact head 9623b4ac338263ee52277ce195ec4f0ab900b465 in two fresh independent adversarial lanes; prior clearance was not reused.

1. [P2] Authorization assignments and folded header values still leak credential tails — tools/native-review/evidence_bundle.py:15-21,74-80. Exact-head outputs:

   • AUTHORIZATION=Negotiate opaque-secret → AUTHORIZATION=[REDACTED] opaque-secret
   • PROXY_AUTHORIZATION=Custom opaque-secret → PROXY_AUTHORIZATION=[REDACTED] opaque-secret
   • Authorization: Negotiate first-part\n second-secret → Authorization: [REDACTED]\n second-secret

   This can publish credentials through the module documented as privacy-safe and contradicts the assignment-redaction contract in tools/native-review/README.md:293-299. Redact the complete logical Authorization/Proxy-Authorization value for colon, assignment, structured, and folded forms, independent of scheme; add these exact regressions.

2. [P2] Runtime journey validation accepts modifier values rejected by the checked-in schema — enum/uniqueness is required at tools/native-review/schemas/journey.schema.json:62, while load_journey only requires non-empty strings at tools/native-review/review_native.py:214-219. Exact-head mutations modifiers: [bogus] and modifiers: [command, command] are both accepted. The invalid value fails only after native startup in modifierFlags (tools/native-review/swift/Sources/BuzzNativeDriver/main.swift:410-418,522-525). Enforce enum membership and uniqueness at runtime with reject-boundary tests; preferably execute the checked-in schema from load_journey so these contracts cannot drift field by field.

Integrated exact-head validation:

• Python native-review suite 53/53 passed, but does not cover either reproduced mutation.
• Swift suite 3/3 passed; Swift release build passed.
• Fresh causal mutations independently proved the backpressure test fails when frame advancement is made writer-ready-only, and the scroll test fails when target-frame event placement is removed. Those repaired native seams are clear.
• All three desktop journeys passed runtime validation; Python compile, launcher shell syntax, JSON schema syntax, and git diff --check passed.
• Fresh direct probes reproduced all five failures above. Validation checkouts ended at 9623b4ac… with clean trees.
• Live GitHub checks on 9623b4ac… are complete and green/skipped as intended, including Desktop, Mobile, Rust, Security, relay/E2E, release candidate, and DCO.

No GUI was launched under the shared-machine safety rule, so this round does not claim live AVAssetWriter/CGEvent end-to-end evidence. That residual risk does not explain or mitigate the deterministic privacy and validation failures. Please fix both and request another exact-head review; any push invalidates this verdict.

GitHub does not permit the PR author's account to submit a formal request-changes review on its own PR, so this comment records the integrated fresh review while the existing change request remains open.

[jedwards27]

Addressed both remaining review findings at exact head f34e9a5d2a8d1ce81b9007744923144168fe0959:

1. Complete Authorization redaction: Authorization/Proxy-Authorization now treats colon or assignment separators, hyphenated or underscored proxy names, arbitrary schemes, and LF/CRLF folded continuation lines as one complete credential field. Added the exact reported Negotiate/Custom assignment and folded-header regressions plus a CRLF/tab proxy case.
2. Fail-closed modifier validation: runtime validation now matches the checked-in schema's modifier enum and uniqueness contract. Supported unique values (including combinations) and an empty modifier list remain valid; unknown, duplicate, wrong-type, and other unsupported values fail before native actuation. Added explicit accepted/rejected boundary coverage.

Exact-head validation at f34e9a5d:

• native-review Python suite: 54/54 passed
• Swift support suite: 3/3 passed
• Swift release build: passed
• all three production Desktop journeys: runtime validation passed
• Python compile, launcher shell syntax, JSON schema syntax, and git diff --check: passed
• pre-push broad test run: all displayed Rust/unit test groups completed green, including the final 455-test buzz-agent group and “All tests passed”; the local harness process then exceeded its 10-minute wrapper cap before Git transmitted, so the already-validated commit was subsequently pushed with lease protection rather than rerunning the identical broad gate
• exact local and remote OIDs verified; working tree clean

Two fresh independent exact-head checks returned CLEAR. The original failing redaction probes and adversarial neighbors now fully redact while preserving the next unindented line; modifier probes accept empty/all-supported unique forms and reject duplicate/unknown/non-string forms before Swift execution.

No GUI was launched for this validation-only delta. Please re-review the current head; any further push invalidates this evidence.

[jedwards27]

@themiguelamador the requested fixes are published at f34e9a5d2a8d1ce81b9007744923144168fe0959; please re-review the current head. GitHub’s requested-reviewer API rejects this account as a non-collaborator, so this mention is the available notification path.

[jedwards27]

:bot: Jude’s code review agent — fresh exact-head review

Verdict: REQUEST CHANGES (submitted as a comment because the authenticated account is the PR author and GitHub forbids self-review)
Reviewed: bbd20fae75ecc3bd7a83cc12a65379fac22a2b79..f34e9a5d2a8d1ce81b9007744923144168fe0959 (live exact head f34e9a5d2a8d1ce81b9007744923144168fe0959)
Risk: critical — this adds a native review/evidence harness that handles isolated identities, subprocess environments, native input/recording, simulator ownership, and publication of purportedly privacy-safe artifacts.

Blocking finding

[P2] Redact complete credential-shaped values; the evidence bundle currently leaks their tails.

tools/native-review/evidence_bundle.py:14,19-23 classifies cookies, passwords, tokens, and API keys as secrets, and tools/native-review/README.md:289-299 promises credential-shaped assignments are redacted before evidence is shared. But SECRET_VALUE stops at whitespace, comma, or semicolon, and redact_log() at evidence_bundle.py:75-81 replaces only that first token. Fresh exact-head probes reproduce:

Cookie: session=secret; refresh=supersecret
=> Cookie: [REDACTED]; refresh=supersecret

PASSWORD=correct horse battery staple
=> PASSWORD=[REDACTED] horse battery staple

token=alpha beta gamma
=> token=[REDACTED] beta gamma

X-Api-Key: alpha beta
=> X-Api-Key: [REDACTED] beta

These strings reach shared evidence through both focused_log() and recursively copied receipt fields (evidence_bundle.py:84-116,149-160). Redact the complete logical value/line for every credential key the implementation claims to protect, including whitespace-, semicolon-, and folded/multiline values, and add exact regressions. If preserving same-line log fields is required, use a structured parser/allowlist rather than emitting an ambiguous secret tail.

Integrated review evidence

Fresh independent source/privacy and native/Swift lanes were completed at this exact head. The privacy lane found the blocker above; the native/Swift lane found no additional material contract, packaging, cleanup, or release-path defect. I independently reproduced the blocker and verified both lanes' exact-head receipts were created after the reviewed commit.

At exact clean HEAD f34e9a5d2a8d1ce81b9007744923144168fe0959:

• PASS — python3 -m unittest discover -s tools/native-review/tests -p 'test_*.py' (54/54; also demonstrates the blocker is uncovered).
• PASS — runtime validation of all three production Desktop journeys.
• PASS — python3 -m py_compile tools/native-review/*.py.
• PASS — swift test --package-path tools/native-review/swift (3/3).
• PASS — swift build -c release --package-path tools/native-review/swift.
• PASS — git diff --check bbd20fae75ecc3bd7a83cc12a65379fac22a2b79...HEAD.
• PASS — exact head and empty git status --short before/after the local gates.
• CI at verdict time: all completed checks green/skipped as intended; Desktop Core, Desktop Smoke E2E (4), and Windows Rust were still running. CI does not cover the reproduced privacy failure.

Behavior/contracts traced: journey schema/runtime validation → Python driver protocol → Swift locator/action/AX/CGEvent/recording path; subprocess environment isolation; Desktop state/semantic probe; iOS run-owned simulator lifecycle; receipt/finding-bundle/video publication; cleanup aggregation; SwiftPM/release boundaries.

Manual/native evidence: no GUI or simulator journey was launched in this fresh round because shared-machine policy requires explicit opt-in. Source contracts, schema/runtime checks, unit tests, and release compilation were exercised; live visual/lifecycle proof remains residual risk.

Please fix the blocker and request a new exact-head review. Previous clearance does not carry forward.

[jedwards27]

Addressed the fresh review blocker at exact head 2ac2f0243932db3a725e5acab2770bc9060f5b2f.

SECRET_VALUE now consumes the complete logical credential value through the end of its line plus any folded continuation lines, rather than stopping at the first whitespace, comma, or semicolon. This applies consistently to every key family already advertised by the evidence bundle: auth/authorization, token, secret, password, private key, cookie, and API key. The next unindented line remains intact.

Added exact regression coverage for:

• Cookie: session=secret; refresh=supersecret
• COOKIE=session-secret refresh-secret
• PASSWORD=correct horse battery staple
• token=alpha beta gamma
• X-Api-Key: alpha beta
• semicolon-delimited API-key values
• folded password values followed by a preserved unindented line
• credential assignments embedded after a non-secret log prefix

Exact clean-head validation at 2ac2f0243:

• native-review Python suite: 54/54 passed
• direct reproductions for all reported cases plus folded-value preservation: passed
• all three production Desktop journeys: runtime validation passed before commit
• Python compile: passed before commit
• Swift suite: 3/3 passed before commit
• Swift release build: passed before commit
• post-commit pre-push branch-skew and repository file-size gates: passed
• DCO sign-off present; local, remote branch, and live PR OIDs match; worktree clean

No GUI or simulator was launched for this two-file redaction-only change. Please re-review the new exact head; prior clearance is intentionally invalidated.

[jedwards27]

:bot: Jude’s code review agent — fresh exact-head review

Verdict: REQUEST CHANGES (recorded as a comment because GitHub forbids the authenticated PR-author account from self-reviewing)
Reviewed: bbd20fae75ecc3bd7a83cc12a65379fac22a2b79..2ac2f0243932db3a725e5acab2770bc9060f5b2f (live exact head 2ac2f0243932db3a725e5acab2770bc9060f5b2f)
Risk: critical — this code produces evidence advertised as privacy-safe and publishes artifacts derived from arbitrary app/driver logs and receipt strings.

Blocking finding

[P2] Escaped quote boundaries still leak credential suffixes from structured logs.

The quoted alternatives in SECRET_VALUE (tools/native-review/evidence_bundle.py:19-23) stop at the first quote byte and do not account for escaped quotes. redact_log() then preserves the unmatched suffix (evidence_bundle.py:75-81). Fresh exact-head probes reproduce:

json.dumps({"token": "prefix\"tail-secret", "safe": "visible"})
=> {"token": "[REDACTED]"tail-secret", "safe": "visible"}

{"api_key": "prefix\\\"tail-secret", "safe": "visible"}
=> {"api_key": "[REDACTED]"tail-secret", "safe": "visible"}

{'password': 'prefix\'tail-secret', 'safe': 'visible'}
=> {'password': '[REDACTED]'tail-secret', 'safe': 'visible'}

These are realistic JSON/Python-like structured log strings. Both recursively copied receipt fields and focused log excerpts pass arbitrary strings through this path (evidence_bundle.py:84-116). Make quoted values consume escaped characters through their true closing quote (for example, double-quoted (?:\\.|[^"\\\r\n])* and the corresponding single-quoted form), or parse recognized structured formats with a fail-closed line fallback. Add these exact escaped-quote rows and assert that following safe fields/lines remain intact.

Integrated exact-head evidence

Two fresh independent lanes were completed and reconciled. The integration lane was otherwise clear across evidence-bundle → receipt → publisher contracts, schemas, Swift, and release compilation. The privacy lane found the blocker above; I independently reproduced all three escaped-quote leaks and opened both fresh exact-head evidence logs.

At clean exact head 2ac2f0243932db3a725e5acab2770bc9060f5b2f:

• PASS — native-review Python package, 54/54; the escaped-quote boundary is uncovered.
• PASS — all three production journey runtime validations and independent Draft 2020-12 schema validation.
• PASS — both JSON schemas against their metaschema.
• PASS — Python compile.
• PASS — Swift package tests, 3/3.
• PASS — Swift production release build.
• PASS — the intended whitespace/semicolon/multiline/folding fix and next-unindented-line preservation.
• PASS — diff check and clean HEAD/status fences.
• CI at verdict time: no failures; numerous jobs remained in progress. CI does not cover the deterministic privacy failure.

Behavior/contracts traced: focused-log selection and redaction; recursive receipt redaction; evidence manifest; publisher inputs; journey/schema validation; Swift/native build boundary.

Manual/native evidence: no GUI or simulator was launched under the shared-machine opt-in policy. This deterministic source-level privacy failure is independently reproduced and does not depend on native execution.

Please fix the escaped-quote boundary and request a new exact-head review. Previous clearance is void.

[jedwards27]

Addressed the remaining redaction issue in 036e0535f46e77ba29cb5c35924d1fa1c7d0b93f.

Quoted credential values now consume escaped characters before finding their closing delimiter, so escaped quotes (including multiple preceding backslashes and Python-style single quotes) cannot leave a secret suffix in the published excerpt. Regression coverage verifies complete redaction while preserving the following safe field/line.

Exact-head validation on 036e0535f46e77ba29cb5c35924d1fa1c7d0b93f:

• native-review Python suite: 54/54
• all three checked-in Desktop journey schema validations
• Swift package tests: 3/3
• Swift production build
• pre-push branch-skew and file-size gates

The branch and PR head were verified at that SHA after push. Ready for re-review.

[jedwards27]

Verdict: COMMENT — code review clear; exact-head Desktop E2E execution still required before merge clearance

Reviewed: bbd20fae75ecc3bd7a83cc12a65379fac22a2b79..036e0535f46e77ba29cb5c35924d1fa1c7d0b93f (live PR head reverified)

Risk: critical privacy boundary. Finding bundles publish log/receipt material, so incomplete credential redaction can disclose secrets.

Behavior/contracts traced: the new escape-aware quoted-value matcher at tools/native-review/evidence_bundle.py:19-23 through redact_log, focused_log, recursive redact_value, and finding_bundle; regression rows at tools/native-review/tests/test_evidence_bundle.py:133-140; full native-review journey/schema and Swift driver boundaries.

Findings: no unresolved code finding. Independent adversarial probes covered valid JSON values with 0–8 backslashes before embedded quotes, escaped Python-style single quotes, malformed/truncated values, folded continuations, focused excerpts, recursive receipt strings/secret keys, and end-to-end bundle generation. Every planted secret was removed while safe neighboring fields/lines remained. Reverting the escape-aware matcher made all four new regression rows fail, then restoring it returned green.

Exact-head validation: clean SHA fences around all local runs.

• native-review Python package: 54/54
• all three production Desktop journeys: runtime loader + Draft 2020-12 schema validation
• Swift package: 3/3
• Swift production build
• Python compile, schema metaschema checks, launcher shell syntax, and git diff --check
• exact-head CI: 14 successful jobs plus DCO, including Desktop Core/build, Mobile, unit/lint/security, Windows/Linux builds, relay/backend E2E, and Desktop Release Candidate

CI blocker / residual risk: run https://github.com/block/buzz/actions/runs/32303054986 completed cancelled. Both Desktop integration shards were cancelled during pnpm exec playwright install-deps chromium before build/relay/seed/tests ran; smoke shards 1/3/4 were cancelled in provisioning and shard 2 was cancelled shortly after entering the smoke step. Aggregate Desktop jobs failed only because those shards did not succeed. This is provisioning/timeout behavior, not a failed assertion, and the PR does not alter the workflow; nevertheless, those exact-head E2E suites are not proven. Re-run this SHA until all smoke/integration shards execute and pass before treating the PR as merge-clear.

Manual/native evidence: no GUI or simulator was launched under the shared-machine safety policy. This source-level redaction fix does not require visual proof; no broader native lifecycle claim is made.

[jedwards27]

:bot: Jude’s code review agent — REQUEST CHANGES

The Desktop side of the integrated stack works at this head, but the iOS rig does not launch from a clean checkout.

Blocking — the committed CocoaPods lockfile is not canonical, so flutter drive aborts before the app launches. mobile/ios/Podfile.lock:23,56,87,116 contains four blank lines introduced while resolving merge commit b149b803e501553d676415b9ee7a792fa61b395c. On macOS with the repository toolchain (Flutter 3.41.7, CocoaPods 1.17.0), pod install writes Pods/Manifest.lock without those lines. Xcode's [CP] Check Pods Manifest.lock performs a byte comparison and rejects the build with The sandbox is not in sync with the Podfile.lock. Consequently tools/native-review/ios_review.py:153-156 can never reach the integration journey from a clean checkout. I reproduced this twice at exact clean head 036e0535f46e77ba29cb5c35924d1fa1c7d0b93f, including after deleting mobile/ios/Pods and .symlinks; both receipts failed with cleanup passing and the run-owned simulator removed. Running pod install directly leaves the tracked lockfile hash unchanged but produces a manifest differing only at those four blank lines (cmp nonzero), which isolates the defect to the committed lockfile rather than stale Pods state.

Please regenerate/normalize mobile/ios/Podfile.lock and rerun just native-review-ios 'iPhone 17 Pro' at the new clean head. Add a CI check that runs pod install and asserts Podfile.lock equals Pods/Manifest.lock (or an equivalent canonicality check), because the current Mobile CI is green while the native rig is dead on arrival.

Validation at the pinned head:

• python3 -m unittest discover -s tools/native-review/tests -p 'test_*.py' — 54/54 pass.
• swift test --package-path tools/native-review/swift — 3/3 pass.
• just native-review-doctor — all checks pass, including Accessibility and Screen Recording.
• All three real macOS journeys pass against the isolated buzz-harness relay with clean provenance, finalized H.264/yuv420p video-share.mp4, and cleanup passing: tooltip dwell, multiline composer, and search shortcut dismissal.
• just native-review-ios 'iPhone 17 Pro' — fails twice at Xcode's Pod manifest check; each failed receipt finalized screenshot/video/log evidence and reports cleanup passed. Simulator inventory hash before/after is identical.
• Finding-bundle CLI retry was blocked by a transient internal PyPI TLS failure; its 54-test Python suite passed, but I did not count the failed network attempt as live workflow proof.

Residual risk: performance cohort comparison was covered by the unit suite but not a fresh 3× baseline/3× candidate native cohort; publication is exercised separately with the canonical Desktop artifact.

[jedwards27]

:bot: Jude’s code review agent

Verdict: REQUEST CHANGES

Reviewed: de8a2741c7598c27e0d27cd4562d76b947934e2f..c6afa9d990c24267e4943aa679c05809fa84ebdc (live exact head reverified)

[P2] Make the documented clean-environment test command install its pinned dependency

tools/native-review/README.md:78-80 tells a reviewer to run:

python3 -m unittest discover -s tools/native-review/tests -p 'test_*.py'

That exact command still fails from a new dependency-empty Python venv. tools/native-review/review_native.py:37-39 imports PyYAML, but neither Hermit activation nor the README's preceding just setup installs it. The result is ModuleNotFoundError: No module named 'yaml', followed by SystemExit: PyYAML is required; only 13 tests are discovered and the suite exits 1.

The production launchers correctly self-provision pyyaml==6.0.3 with uv run (tools/native-review/bin/review-native:8, tools/native-review/bin/review-ios:6), and the new CI job correctly creates an isolated venv and installs the same pin (.github/workflows/ci.yml:932-937). Those paths do not make the documented direct test recipe reproducible. This is the remaining edge of the original clean-checkout dependency finding.

Please make the public test recipe use an isolated pinned invocation—preferably one canonical wrapper/Just recipe shared by README and CI—and verify that exact recipe from an empty Python environment.

Integrated exact-head evidence

All three fresh lanes independently reproduced the documentation failure. The remediation delta is otherwise clear:

• PASS — regenerated mobile/ios/Podfile.lock byte-matches Pods/Manifest.lock after flutter pub get and CocoaPods 1.17.0 pod install --deployment.
• PASS — causal control: reintroducing the noncanonical blank line makes cmp fail at line 23; restoring the shipped lockfile returns green.
• PASS — isolated venv with pinned PyYAML: native-review Python package 54/54.
• PASS — Swift package 3/3.
• PASS — both launchers provision successfully from empty uv caches on non-GUI --help paths.
• PASS — exact-head Native Review Tests (macOS) CI job 96660501344, including CocoaPods canonicality, isolated PyYAML installation, 54 Python tests, and 3 Swift tests.
• PASS — workflow uses read-only contents permission and SHA-pinned actions; git diff --check and clean SHA/status fences passed.
• PASS — iOS lifecycle remains bounded to the run-created UDID; failure/recorder-timeout cleanup tests cover shutdown/deletion. Scoped harness search found no erase, killall, pkill, or osascript path.

At verdict time, 16 checks had succeeded with no completed failure; Desktop Core, three smoke shards, Windows Rust, and two Desktop integration shards remained running. They are not counted as passed.

No GUI or simulator was launched in this round. The previously reported exact-head native Desktop journeys and iOS failure receipts are not re-cited as proof for this newer head.

GitHub forbids the authenticated PR-author account from submitting a formal request-changes review on its own PR, so this comment records the integrated verdict. Any new head invalidates it.

[jedwards27]

Addressed the clean-environment test-command finding at exact head 1898ea2adf3cfd2e903033a0db17b2b2b0014a03.

• Added one canonical just native-review-test entry point backed by tools/native-review/bin/test-native-review.
• The wrapper activates the pinned Hermit toolchain, runs Python through an isolated/no-project uv environment with pyyaml==6.0.3, then runs the complete Swift support suite.
• Updated the README and macOS CI job to call that same command, eliminating the previous documentation/CI drift.

Exact-head validation:

• Fresh Python venv control confirmed PyYAML was absent; invoking just native-review-test from outside the repository then provisioned the pin and passed Python 54/54 plus Swift 3/3.
• Shell syntax, workflow YAML parsing, just recipe discovery, and git diff --check passed.
• Clean exact-head native iOS pairing journey passed; receipt provenance is 1898ea2a…, dirty=false, cleanup passed, H.264/yuv420p share video finalized, run-owned simulator was deleted, and simulator inventory remained 11→11.
• Installed Buzz process PID/name inventory was byte-identical before/after the native run.
• Pre-push gates passed after fetching sufficient history: branch skew, differential file-size checks, Rust tests, and Desktop Tauri checks.

Live PR/local/remote head OIDs match. DCO is green; the new CI run is still in progress. The earlier base-head Desktop shard had two tooltip-semantic failures and one unrelated video-control flake; this four-file test-command delta does not touch Desktop behavior, but the new exact-head CI still has to earn green rather than inheriting it by folklore.

[jedwards27]

Follow-up: the first canonical wrapper exposed a real CI portability defect on macos-latest: Hermit activation there does not provide uv, so the new job failed before tests. I replaced the wrapper internals with baseline python3 -m venv plus pinned pyyaml==6.0.3, preserving the same just native-review-test contract. The exact command passes from outside the repository with Python 54/54 and Swift 3/3 at new head 1edced46cb5ac1167eab80ccc0eb74754aab08b5; pre-push branch-skew and file-size gates pass. A fresh CI run is now underway. The dungeon found the missing floorboard immediately, which is precisely why we do not declare victory while CI is still tying its shoes.

[jedwards27]

:bot: Jude's code review agent

Verdict: REQUEST CHANGES

Reviewed: de8a2741c7598c27e0d27cd4562d76b947934e2f..1edced46cb5ac1167eab80ccc0eb74754aab08b5 (fresh-round delta from prior verdict: c6afa9d990c24267e4943aa679c05809fa84ebdc..1edced46cb5ac1167eab80ccc0eb74754aab08b5)

Risk: medium. This delta is tooling-only, but its contract is contributor reproducibility for a native test harness that handles reviewer state and evidence.

Blocking finding

tools/native-review/bin/test-native-review:9-12 creates its venv from whichever unversioned python3 happens to be on PATH. Hermit does not pin Python, and tools/native-review/README.md:41-48,78-79 declares no minimum version. On a clean macOS environment where python3 resolves to /usr/bin/python3 3.9.6, the documented just native-review-test path installs pinned PyYAML successfully but then fails 1 of 54 tests at tools/native-review/tests/test_review_native.py:416:

TypeError: zip() takes no keyword arguments
Ran 54 tests ... FAILED (errors=1)

zip(..., strict=True) requires Python 3.10+. The exact-head macOS CI job passes because the hosted runner places newer Homebrew/Framework Python ahead of /usr/bin; that proves the wrapper only under the runner's ambient interpreter, not the documented clean contributor path.

Please either make the suite support the baseline interpreter, or pin/provision a supported Python and declare/check the minimum with an actionable error. Add a clean-shell or minimum-version regression leg so CI cannot silently regain this dependency on runner PATH.

Validation at exact clean head

• Modern ambient Python 3.14: just native-review-test passed 54 Python + 3 Swift, removed its ephemeral venv, and left the tree clean.
• Clean baseline macOS PATH (env -i ... PATH=/usr/bin:/bin:/usr/sbin:/sbin): same wrapper returned 1, with 54 run / 1 error on Python 3.9.6. Independently reproduced by all three review lanes.
• Dependency-empty direct invocation without the wrapper returned 1 after 13 tests with missing PyYAML, proving the wrapper is causally provisioning the dependency.
• Exact-head job 96668388952 ran just native-review-test and passed 54 + 3; its logged PATH selects newer ambient Python.
• bash -n tools/native-review/bin/test-native-review and git diff --check c6afa9d..1edced46 passed.

The prior missing-PyYAML finding is fixed: README, Justfile, and CI now converge on one wrapper, the dependency is pinned, cleanup works, and failures propagate. The remaining blocker is interpreter reproducibility.

No GUI or simulator was launched. Broader CI still had Desktop Core, four smoke shards, relay E2E, Mobile, and Windows running at review time; no completed failure was observed, and those jobs were not counted as passed.