Review · codex-ce-code-review-01 · Operator task workspace

High

[x] AUTO-FIX: Validate and redact agent-asserted repository and Wiki fields (lib/hive/context_provenance/context_receipt.rb:131): The validator accepts arbitrary nested values without typed checks or secret redaction, so hostile receipt content can reach authenticated HTML and JSON.
[x] AUTO-FIX: Disable repository-local fsmonitor during provenance Git reads (lib/hive/context_provenance/wiki_snapshot.rb:26): git status honors core.fsmonitor from repository config, allowing controller-side command execution while capturing advisory provenance.
[x] AUTO-FIX: Protect controller-owned workspace receipts during agent custody (lib/hive/stages/execute.rb:145): The writable task folder contains unprotected context receipts, projection checkpoints, and activity receipts that an agent can rewrite and later present as trusted evidence.
[x] AUTO-FIX: Validate the complete checkpoint prefix (lib/hive/task_projection/store.rb:313): Only the first and last 4 KiB are hashed, so a same-size mutation in the middle of a larger journal prefix is accepted as current immutable history.
[x] AUTO-FIX: Handle a current checkpoint with an empty journal suffix (lib/hive/task_projection/store.rb:336): Reading immediately after rebuild! raises EOFError, then the degradation path calls dig on TaskProjection, leaving a healthy workspace projection unavailable.
[x] AUTO-FIX: Project stack and publication facts for every connected dependency node (lib/hive/task_workspace/builder.rb:234): Production composition supplies Git observations only for the root task, so required ancestor and descendant divergence or absent-PR evidence is always unavailable.
[x] AUTO-FIX: Fail closed when workspace action evidence is degraded (lib/hive/task_workspace/builder.rb:281): Action enablement and rendered mutation controls consult status-feed freshness only, so partial, stale, truncated, or conflicting workspace evidence can still advertise enabled actions.
[x] AUTO-FIX: Bound dependency cycle analysis before traversal (lib/hive/task_workspace/dependency_component.rb:228): Recursive DFS runs across the full inventory before node, edge, depth, or deadline caps and can raise an uncaught SystemStackError instead of returning a partial panel.
[x] AUTO-FIX: Do not report absent attempt usage as zero (lib/hive/task_workspace/resources.rb:117): An available query with no attributed sessions is labeled current with zero totals, fabricating observed usage contrary to the resource-truth contract.
[x] AUTO-FIX: Issue an older cursor when the timeline byte cap drops material events (lib/hive/task_workspace/timeline.rb:125): Byte truncation does not set material_truncated, so omitted decisions and retries become unreachable despite truncated: true.
[x] AUTO-FIX: Page timeline history beyond the newest bounded source window (lib/hive/task_workspace/timeline.rb:353): Cursors only filter the already-loaded suffix and never seek an earlier bounded window, so material history older than 1 MiB or 2,000 events cannot be retrieved.
[x] AUTO-FIX: Define typed record contracts in hive-task-workspace.v1 (schemas/hive-task-workspace.v1.json:161): Every panel accepts generic SafeValue records and arbitrary extra properties, so malformed attempts, resources, timeline entries, dependencies, publication facts, and artifacts still validate.
[x] AUTO-FIX: Enforce one total deadline for GitHub refreshes (web/app/models/github_api.rb:174): Connection and per-read timeouts do not bound total elapsed time, allowing a drip-fed response to hold the request and cache lock beyond the required ten seconds.
[x] AUTO-FIX: Classify legacy ERROR and EXPECTED status contexts correctly (web/app/models/github_api.rb:222): Both states are normalized as completed and evade failure or pending checks, causing failed or awaited CI to render as an open publication.
[x] AUTO-FIX: Key permanent diff and publication frames by task identity (web/app/views/tasks/show.html.erb:63): Constant data-turbo-permanent IDs let Turbo preserve task A's loaded diff, publication evidence, and controls beneath task B's header.

Medium

[x] AUTO-FIX: Scrub absolute paths from local Git diagnostics (lib/hive/task_workspace/publication.rb:508): Git stderr receives secret redaction but no path scrubbing before its SourceError message enters authenticated workspace JSON.
[x] AUTO-FIX: Honor GitHub Retry-After before refreshing again (lib/hive/task_workspace/publication_cache.rb:457): The cache stores the server cooldown as diagnostic text but enforces only the local 60-second interval, permitting premature repeat requests.
[x] AUTO-FIX: Keep raw noise-group cursors below their decoder limit (lib/hive/task_workspace/timeline.rb:322): Encoding every member ID can emit tokens larger than 8 KiB that the same endpoint always rejects during expansion.
[x] AUTO-FIX: Remove the full diff from the live region (web/app/views/tasks/diff.html.erb:25): The role=status and aria-live=polite container includes every patch <pre>, so assistive technology can announce the entire diff on lazy load.
[x] AUTO-FIX: Do not commit the compiled managed-Wiki log (wiki/log.md:6): This feature branch changes the generated aggregate despite the repository rule to commit only wiki/log.d fragments in feature PRs.

Nit

[x] AUTO-FIX: Point the answer posture at an existing question anchor (web/app/views/tasks/_workspace_summary.html.erb:11): The decisive-evidence link targets #task-questions, but no rendered task element defines that ID.