Repository navigation
fix: validate exact Origin deployment probe target - #2546
Open
groupthinking with Copilot wants to merge 2 commits into
Open
groupthinking with Copilot wants to merge 2 commits into
groupthinking with Copilot wants to merge 2 commits into
Conversation
Contributor
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
Contributor
|
Important Review skippedBot user detected. To trigger a single review, invoke the
 |
Contributor
🔍 PR Validation✅ Current validation passed. |
Co-authored-by: groupthinking <154503486+groupthinking@users.noreply.github.com>
github-actions
Bot
added
javascript
Contributor
✅ E2E Test Results: ALL TESTS PASSED
Test Output |
Copilot
AI
changed the title
[WIP] Ensure live deployment probe accepts only exact claimed HTTPS URL
fix: validate exact Origin deployment probe target
Nov 2, 2026
groupthinking
approved these changes
Nov 2, 2026
Contributor
There was a problem hiding this comment.
🟡 Changes recommended
The remaining probe mock returns an unnormalized URL, causing the existing PASS-receipt preservation assertion to receive HOLD and fail.
1 open issue
What changed in this PR
This PR tightens UVAI’s Origin G.A.T.E. evidence validation for #2410: a successful deployment probe must report the canonical signed target URL, otherwise the transition remains on HOLD. Deployment execution and provider ownership verification remain outside scope.
Changes:
- Require the probe’s final URL to match the canonical signed deployment URL.
- Normalize the Origin gate test mock and add regression coverage for substituted URLs.
| File | Description |
|---|---|
apps/web/src/lib/origin-gate.ts |
Holds transitions when the probe fails or reports a different URL. |
apps/web/src/lib/__tests__/origin-gate.test.ts |
Normalizes mock URLs and tests rejection of substituted probe URLs. |
Review effort: Balanced
| } | ||
| const probe = await probeLiveDeploymentUrl(proposal.target.liveUrl); | ||
| if (!probe.ok) { | ||
| if (!probe.ok || probe.finalUrl !== new URL(proposal.target.liveUrl).href) { |
This branch was successfully deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Canonical issue
Linked automatically by the repository workflow.
Outcome
G.A.T.E. only accepts a successful reachability probe when its final URL matches the canonical URL of the signed deployment target. A substituted URL results in HOLD.
Scope
probe.finalUrlagainst the signed target and add a regression test for substituted URLs.Risk
Verification
Current head:
1e1b746npm test --workspace=apps/web -- src/lib/__tests__/origin-gate.test.ts src/lib/__tests__/live-deployment-probe.test.ts(130 passed, 26 skipped)Production evidence
No production deployment performed; this change only validates deployment evidence.
Agent handoff
Security dependency evidence
Not applicable; no dependency changes.