feat(ISSUE-263): W3-C4 CNB dispatch 通道与 fallback (#280) - #74
Merged
Conversation
- pipeline/adversary/cnb_bridge.py：CNB dispatch 通道 + canary + fallback 链 - CNB_TOKEN org secret 注入；canary 先行（30-60s echo 任务） - 窗口抢占/投递/轮询/收集；fallback 链 CNB→自有 API→no-attempts - 连续 3 次 fallback 或额度尽 → 自动开 type:infra issue - 凭据面扫描（INV-06 负向断言：沙箱内零 GitHub 凭据） - 输出 schema=cnb-bridge-report/v1，与 W3-C1 adversary 接口兼容 Closes Cloudbird-Software/.github#280
cloudbrid-agent
Bot
force-pushed
the
feat/issue263-w3-c4
branch
from
August 23, 2026 08:53
ec0594c to
cfdf60a
Compare
randypanding
added a commit
that referenced
this pull request
Aug 26, 2026
对近一周（#21..#124）全部 PR 复盘后的机械债清理：仅删除 AST 级验证 「全仓零引用」的未用导入/未用名，不改任何判定逻辑、阈值、白名单或 policy 数据。逐文件出处： - pipeline/adversary/cnb_bridge.py：删未用 `from typing import Any`（#73/#74） - pipeline/adversary/golden_set.py：删未用 `from typing import Any`（#80/#82/#83） - pipeline/adversary/holdout_registry.py：删未用 `from typing import Any`（#81/#82） - pipeline/adversary/e2e/e2e-runner.py：删未用 `from typing import Any`（#89） - pipeline/adversary/llm_verifier.py：删未用 `import math`；可选库导入行去掉 未用名 extract_score（call_verifier/create_openai_client 均在用，保留）（#72/#76） - pipeline/entropy/tests/test_e2e.py：删未用 `import sys`（#56） - pipeline/selftest-c/tests/test_registry.py：删未用 `import copy`（#103） - pipeline/trust-gate/tests/test_adjudicate.py：删未用 `import copy`（#63） - pipeline/trust-gate/tests/test_cli.py：from-import 去掉未用名 PREDICATES/UNLOCK_STATE（保留 trust_gate 可导入性冒烟导入与 noqa 惯例）（#63） - scripts/dep-supply-chain-check.py：删未用 `import copy`（#36/#43） 刻意不动（已核验非死代码）：各模块 `from __future__ import annotations`； fuzz/sast/symbolic 的 `_yamlmini` 双模式导入守卫（noqa F401，保证包路径）； golden_set 等 try-import yaml 的环境 fail-closed 守卫；org-gate / suppression-gate / adversary-gate 等关卡 workflow 与 policy/suppressions.yaml 基线数据——门语义一概不变。 验证： - py_compile 全部 scripts/pipeline *.py 通过；bash -n 全部 *.sh 通过 - workflows/policy/pipeline 共 62 个 YAML 解析通过 - scripts/test-integrity-fixtures/run.sh、scripts/suppression-budget-selftest.sh 通过 - python -m unittest：trust-gate test_adjudicate+test_cli 17 例、 selftest-c tests.test_registry 14 例、entropy tests.test_e2e 10 例——全绿 Co-authored-by: randypanding <randypanding@users.noreply.github.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
关联卡片：Cloudbird-Software/.github#280
父意图/验收规范：Cloudbird-Software/.github#263 | Spec:
specs/ISSUE-263/spec.mdv5变更内容
pipeline/adversary/cnb_bridge.py— CNB dispatch 通道 + canary + fallback 链CNB_TOKENorg secret 注入，canary 先行（30–60s echo 任务验证云端存活后再派真实任务）ghp_/gho_/x-access-token:ghs_等凭据形状即拒绝（fail-closed）CNBBridge.dispatch+poll）CNB → 自有 API（ADR-0048 直连 provider）→ no-attemptstype:infraissue 报人no-attempts→ 锁needs-human+ 自动开 issue，不产出判定--issue/--spec-path/--card-id，输出cnb-bridge-report/v1JSON 元数据）Closes Cloudbird-Software/.github#280