docs: bound daemon-state host-port warning - #236
Conversation
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 8b6ba42114
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| response. Missing, stale, duplicate, malformed, or collided facts produce no | ||
| finding. | ||
|
|
||
| `docker.daemon_state_bind_mount_publishes_port` emits a warning only when the |
There was a problem hiding this comment.
The new rule is classified as a warning, but the “Current finding policy” at lines 192–199 reserves warnings for service-state declarations or the single daemon-state fact and reserves combinations of directly observed Docker facts for advisories. This two-fact rule therefore matches the documented advisory category while being labeled a warning, leaving contradictory guidance for operators and future rule authors; update the policy or document why this rule is an exception.
Useful? React with 👍 / 👎.
59f7f52 to
35ec44f
Compare
8b6ba42 to
ee1e252
Compare
7431648 to
466d55e
Compare
ee1e252 to
63d696d
Compare
466d55e to
fb13075
Compare
63d696d to
1e008dc
Compare
1 participant
Summary\n- document the correlated daemon-state and validated host-port warning as a static, read-only review projection\n- record the exact fresh V1 Docker-pair, same-observation requirements and fail-closed suppression cases\n- state the nonclaims: no reachability, traffic, exploitability, compromise, breach, impact, or causality conclusion\n\n## Validation\n- \n\nThis stacks on #235 and does not claim that issue #69 is fully resolved.