Repository navigation
Conversation
213f3ed to
ce22471
Compare
|
Rebased onto the latest No review comments on this PR. CI will verify the build and test gate. |
ce22471 to
9cbda84
Compare
🔐 Codex Security Review
|
|
Rebased onto the latest Still-needed assessment: No upstream commits in the 62-commit window address the same issue. This PR remains needed. Review requests: |
9cbda84 to
d682576
Compare
|
Rebased onto current Still needed: Checked all 38 new upstream commits for overlap with this PR's topic. None of the upstream changes address the issue this PR fixes. The PR remains relevant. Verification:
|
d682576 to
daf2a5a
Compare
Rebase and review — 2026-09-03Base commit: Accuracy review: Workflows still cannot add reactions to messages. |
daf2a5a to
9690700
Compare
Rebase and review update — Sep 3, 2026Rebased onto latest main ( Accuracy review: Main defines Mergeable status: Confirmed MERGEABLE on GitHub after force-push. |
9690700 to
ebb1381
Compare
Rebase pass — Sep 5, 2025Rebased onto current upstream main ( Rebase resultRebased cleanly onto current main. No conflicts. Still-needed assessmentChecked all 62 new main commits for overlap with this PR's topic. None obsoleted:
Verification
|
ebb1381 to
8e2af98
Compare
Rebase pass — Sep 9, 2026Rebased onto current upstream main ( Rebase resultRebased cleanly onto current main. No conflicts. Still-needed assessmentChecked all 8 new main commits for overlap with this PR's topic. None obsoleted. None of the 8 new main commits add reaction events to workflows. Verification
|
8e2af98 to
cc1217e
Compare
Rebase pass — Sep 16, 2026Rebased onto current upstream main ( Rebase resultRebased cleanly onto current main. No conflicts. Still-needed assessmentNone of the 37 new main commits add reaction events to workflows. Verification
What was not doneNo local test suites were run. The rebase only repositions commits; conflict resolutions carry the same logical changes forward (CI will verify builds). |
BradGroux
left a comment
BradGroux
left a comment
There was a problem hiding this comment.
Review refresh — 2026-10-02
Reviewed against current main 5a4b2d3d.
Verdict: Still needed, but the current patch has a channel-scoping defect.
Blocking finding: The immutable kind-7 reaction built in workflow_sink.rs includes e, p, actor, workflow, and nonce tags but omits the required h channel tag. The new E2E subscribes with both e and h, so it cannot receive the event as signed; channel-scoped reaction subscribers will miss it as well. Add ["h", channel_uuid] before signing and assert it in coverage.
Rebase check: The branch rebases cleanly. Focused workflow/relay tests are still required after the correction.
No branch update was pushed in this pass because updating the PR head would trigger the repository's pull_request GitHub Actions workflows, which this workstream is not authorized to trigger.
Co-authored-by: Brad Groux <bradgroux@hotmail.com> Signed-off-by: Brad Groux <bradgroux@hotmail.com> Signed-off-by: Brad Groux <3053586+BradGroux@users.noreply.github.com>
cc1217e to
eeb9301
Compare
|
Still relevant on current Workflow library and workflow-sink tests passed, alongside strict workflow/relay all-target Clippy, formatting, file-size, and diff checks. The updated persistence/deduplication/deletion regression compiles but was not executed without local Postgres/Redis; live delivery remains unverified. Head: |
Publish workflow
add_reactionactions as signed kind-7 reactions through the existing relay event path. Include channelh, targete, target-kindk, target-authorp, and existing workflow-owner attribution. Resolve delegated authors through the same attribution helper as ingest and keep duplicate execution idempotent.Read the target and channel through the writer-consistent authorization boundary and enforce target reader visibility before reacting. Keep the existing membership/archive checks and deletion/re-add behavior.
Fixes #2395.
Verification
Rebased onto
mainat2d289f720de0, retaining upstream workflow-sink tests. Updated the Postgres regression to current community/deletion APIs and asserted the signed channel tag. Workflow library tests and workflow-sink unit tests pass, as do strict workflow/relay all-target Clippy, formatting, file-size, and diff checks.Postgres/Redis-backed signed persistence, deduplication, deletion/re-add, and live relay delivery were not exercised in this refresh because the local services are unavailable. The updated database regression compiled but remains ignored.
No public reaction REST endpoint or client rendering change is added. Manual triggers still lack a triggering message ID, and custom emoji metadata remains limited to the existing content field.